XPR Web Scraping

Tools for fetching and extracting cleaned text, metadata, and links from single or multiple web pages with format options and link filtering.

This skill appears to be a coherent, self-contained web scraper that doesn't request secrets or install external code. Before installing: (1) review the full src/index.ts (the provided snippet was truncated) to confirm there are no hidden network callbacks or logging endpoints; (2) ensure use complies with target sites' robots.txt, terms of service, and legal/privacy rules; (3) enforce rate limits and avoid scraping protected or paywalled content; (4) if you run in a sensitive environment, sandbox the skill (or review for any unexpected outbound endpoints) before enabling autonomous invocation.

Type: OpenClaw Skill Name: xpr-web-scraping Version: 0.2.11 The skill provides web scraping functionality using Node.js built-in fetch. While the code is generally well-behaved and lacks direct evidence of malicious intent (e.g., no data exfiltration, persistence, or malicious execution), the `scrape_url` tool in `src/index.ts` allows arbitrary HTTP headers to be passed via the `headers` parameter. This capability, though plausibly needed for advanced scraping, presents a risky vector for misuse by a malicious prompt. An attacker could instruct the agent to send crafted headers for various attack scenarios against the target web server (e.g., authentication bypass, HTTP header injection, or to trigger specific server-side behaviors), making it a 'risky capability without clear malicious intent'.