urlcheck
Warn
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@cybrlab/urlcheck-openclawplugin from an unverified third-party source not listed among trusted vendors. - [PROMPT_INJECTION]: The skill processes untrusted URL strings and user intent descriptions, which is a common vector for indirect prompt injection.
- Ingestion points: External URLs are ingested through the
urlparameter in theurl_scanner_scanandurl_scanner_scan_with_intenttools (SKILL.md). - Boundary markers: The skill does not implement explicit delimiters or 'ignore embedded instructions' warnings for the data it processes.
- Capability inventory: The skill's capabilities are limited to calling the scanner tools; there are no direct subprocess calls, file-write operations, or shell executions present in the provided files.
- Sanitization: No input validation or sanitization is performed on the URLs before they are passed to the external scanning tools.
Audit Metadata