Is donatasdecodo/decodo-scraper safe?
Yes. donatasdecodo/decodo-scraper is safe to install. Oathe's behavioral security audit gave the decodo-scraper skill by donatasdecodo a trust score of 90/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/donatasdecodo/decodo-scraper
Is donatasdecodo/decodo-scraper safe to install?
This skill provides legitimate web scraping functionality through the Decodo commercial API service. The code is straightforward and contains no malicious behavior, but users should be aware that queries and URLs are transmitted to an external service.
What security issues were found in donatasdecodo/decodo-scraper?
Category Scores
Findings (3)
MEDIUM User data transmitted to external API -25 ▶
The skill sends user search queries, URLs, and API authentication tokens to scraper-api.decodo.com. While this is the documented functionality, it could expose sensitive information if users provide sensitive search terms or URLs that should remain private.
LOW External service dependency and privacy considerations -15 ▶
The skill depends entirely on a commercial third-party API service. Users should be aware that their scraping requests and potentially the scraped data may be logged or retained by Decodo's service according to their privacy policy.
LOW Potential for indirect content injection -5 ▶
While the skill itself contains no prompt injection, it can retrieve arbitrary web content that could potentially contain malicious prompts if fed back to the agent. However, this is inherent to any web scraping functionality.
Should I install donatasdecodo/decodo-scraper?
Oathe's verdict for donatasdecodo/decodo-scraper is SAFE with a trust score of 90/100. Recommendation: Install with caution.