urlcheck

What This Skill Does

The urlcheck skill provides an essential security layer for OpenClaw agents, enabling proactive verification of web resources before any navigation or interaction occurs. By leveraging the @cybrlab/urlcheck-openclaw plugin, the agent gains the ability to perform deep inspections of URLs to detect phishing, malware, and suspicious behavioral patterns. More importantly, it offers intent-aware validation, allowing the agent to determine if a destination site is truly aligned with the user's stated objective (e.g., ensuring a login page is legitimate for the specific service requested). This two-fold approach of threat detection and intent matching minimizes the risk of accidental exposure to malicious sites, credential theft, or social engineering attacks.

Installation

To integrate urlcheck into your environment, follow these steps:

1. Open your terminal and run the installation command: openclaw plugins install @cybrlab/urlcheck-openclaw.
2. Once installed, refresh your environment with openclaw gateway restart.
3. Verify the installation by checking the plugin and skill lists: openclaw plugins list and openclaw skills list.

Use Cases

Use this skill in any scenario where the agent is prompted to move outside of the local environment, including:

• Validating links provided by users in chat or from external documents.
• Verifying URLs found during web research tasks before opening them.
• Ensuring the destination of a redirect chain is safe and relevant to the user's current goal.
• Pre-validating URLs before submitting sensitive data or credentials.
• Assessing the credibility of download sources to prevent malware execution.

Example Prompts

1. "Before you open the link in this email to reset my password, please use the URLCheck tool to verify it's safe and intended for my bank."
2. "I need to download the latest report from the site provided. Please scan the URL first to ensure it's not a phishing attempt and that it aligns with my request to get the document."
3. "Is this website safe for me to log into? My goal is to access my professional portal at the link provided below."

Tips & Limitations

Always prefer url_scanner_scan_with_intent when the user has provided a clear objective, as it provides higher accuracy than basic threat scanning. Note that this skill is not intended for internal network resources like localhost or local file paths, which should be excluded from scanning to maintain performance. The service includes a generous trial tier, but for high-volume automated workflows, contact the developers at [email protected] for enterprise limits. If a scan takes a long time, utilize the asynchronous tools (_async versions) to keep your agent's event loop responsive while the check completes.