web-crawler

SUSPICIOUS. The skill is broadly aligned with its stated web/social scraping purpose, and the flagged command-injection findings are documentation false positives. The main risk is data-flow and trust: it routes user requests and fetched content through multiple third-party scraping intermediaries, including community Apify actors and archive services, which is more expansive than a simple fetch skill. No direct credential harvesting, pre-execution commands, or confirmed malware indicators are present.