Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Added documentation for asynchronous URL scan workflows, including async scan initiation, task status, and result retrieval tools. - Described usage and fields for new async endpoints: `url_scanner_scan_async`, `url_scanner_scan_with_intent_async`, `url_scanner_tasks_get`, `url_scanner_tasks_result`, etc. - Updated field documentation to include `intent_alignment`, clarifying alignment values and their meanings. - Expanded tool unavailability guidance to cover async/task APIs.
What This Skill Does
Verifies URLs for security threats before an agent navigates, clicks, or follows a redirect. Accepts an optional intent parameter to check whether the destination matches what the user is actually trying to do, not just whether it's malicious.
Intent-alignment checking catches cases where a URL is technically safe but not the destination the user meant to reach, which threat-only scanners miss.
When to use it
- Checking a login link before submitting credentials
- Verifying a download URL before fetching a file
- Screening redirects in automated browsing workflows
- Confirming a payment or checkout page matches the user's intended site
- Flagging phishing links in user-provided URLs
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Before I open https://accounts-google.com.login-verify.net, check if it's safe to log in to my Google account
- 1Call url_scanner_scan_with_intent with url='https://accounts-google.com.login-verify.net' and intent='log in to my Google account'
- 2Wait up to 90 seconds for the scan to complete
- 3Read the agent_access_directive field from the result
- 4Check intent_alignment to see if the destination matches a Google login page
- 5Report the directive, risk_score, and intent_alignment finding to the user
DENY directive returned with high risk_score and intent_alignment: misaligned. Agent tells the user the URL does not appear to be a legitimate Google login page and recommends not proceeding.
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.