📦 scrape — 技能工具
v1.0.0Legal web scraping with robots.txt compliance, rate limiting, and GDPR/CCPA-aware data handling. Supports both direct HTTP scraping and managed scraping via...
0· 22·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions and code are generally coherent for a scraper that can optionally call a managed
评估建议
This skill appears to implement a legitimate scraper and a managed scraping option via api.skillbossai.com, but there are a few things to check before installing:
- Metadata mismatch: the registry says no env vars are required but SKILL.md and code read SKILLBOSS_API_KEY. Do not provide any API key until the publisher corrects the metadata or you verify the key's intended use.
- Third-party endpoint: the skill will send requests and scraped content to https://api.skillbossai.com when you use th...详细分析 ▾
ℹ 用途与能力
The SKILL.md and code clearly implement a scraper and an optional integration with a 'SkillBoss API Hub' (api.skillbossai.com) which requires SKILLBOSS_API_KEY — that fits the described purpose. However the registry metadata says 'Required env vars: none' while SKILL.md and code require SKILLBOSS_API_KEY, an inconsistency that should be resolved before trusting the skill.
✓ 指令范围
The runtime instructions focus on robots.txt, ToS checks, rate limiting, PII handling, and using either direct HTTP or the SkillBoss API Hub. The code examples only reference scraping-related files, HTTP requests, and the declared SKILLBOSS_API_KEY; there is no unrelated file/system access or vague 'gather context' language.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files to be executed by the platform. That minimizes install-time risk.
⚠ 凭证需求
Functionality legitimately needs a single API credential (SKILLBOSS_API_KEY) for the managed scraping path — that's proportionate. The concern is the metadata mismatch: the registry lists no required env vars while the SKILL.md and code access SKILLBOSS_API_KEY. Also the SkillBoss API is a third-party endpoint; users should confirm the trust model and key scope before providing credentials.
✓ 持久化与权限
The skill is not marked always:true and does not request persistent system-wide privileges. It is user-invocable and allows autonomous invocation (platform default), which is expected for skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/16
Scrape skill v1.0.0 — initial release with robust legal compliance and managed scraping features: - Enforces robots.txt compliance, terms of service checks, and rate limiting for ethical web scraping. - Includes guidelines for GDPR/CCPA-aware data handling and strict personal data protection. - Supports both direct HTTP-based scraping and managed scraping via SkillBoss API Hub. - Provides a comprehensive pre-scrape checklist and legal boundaries for safe operation. - Requires SKILLBOSS_API_KEY for SkillBoss-managed scraping with automatic anti-bot protection.
● 无害
安装命令
点击复制官方npx clawhub@latest install toby-scrape
镜像加速npx clawhub@latest install toby-scrape --registry https://cn.longxiaskill.com