URLCheck - Intent-aware URL security verifier for agents

You have access to a URL verification system that checks target web resources for security threats and evaluates whether they appear to correspond to the user's browsing goals. Use it to verify any URL before taking the next step — navigating, clicking, opening, or redirecting.

The goal is not only to detect threats but to help assess whether the target resource appears aligned with what the user actually intends to accomplish.

Quick Start (For Users)

• Install plugin and restart gateway:

openclaw plugins install @cybrlab/urlcheck-openclaw
openclaw gateway restart

• Verify plugin and skill:

openclaw plugins list | grep -i urlcheck
openclaw skills list | grep -i urlcheck

• Try it:

Before opening https://example.com, run url_scanner_scan_with_intent with intent "log in to my account" and tell me whether I should proceed.

No API key is needed for trial mode (up to 100 requests/day). For higher limits, contact [email protected].

When to Verify

Verify a URL before any of these actions:

• Opening a link the user provides or that you discover
• Navigating to a page on the user's behalf
• Following a redirect chain
• Downloading a file from a URL
• Submitting credentials to a login page
• Taking any action where the destination matters to the outcome

Which Tool to Use

url_scanner_scan — Threat-focused verification.

• Required parameter: url (the URL to verify).
• Use when the user has not stated a specific purpose. The system

url_scanner_scan_with_intent — Threat verification plus destination-intent alignment.

• Required parameter: url (the URL to verify).
• Optional parameter: intent (the user's stated purpose).
• Use when the user has mentioned a purpose such as "log in",

Prefer url_scanner_scan_with_intent whenever intent is available. This catches mismatches that threat-only analysis may miss — for example, a legitimate site that may not be the one the user intended to use for their goal.

Async workflow tools (non-blocking)

• url_scanner_scan_async and url_scanner_scan_with_intent_async

• url_scanner_tasks_get checks task status.
• url_scanner_tasks_result returns the completed scan payload.
• url_scanner_tasks_list lists current tasks.
• url_scanner_tasks_cancel cancels a queued or running task.

How to Act on Results

Every verification returns an agent_access_directive. Follow it:

• ALLOW — Proceed with navigation. Inform the user briefly that

• DENY — Do not navigate. Tell the user the URL was flagged and

• RETRY_LATER — Verification could not complete (temporary

• REQUIRE_CREDENTIALS — The target requires authentication. Ask

Interpreting Additional Fields

• risk_score (0.0 to 1.0): threat probability. Lower is safer.
• confidence (0.0 to 1.0): how certain the analysis is.
• analysis_complete (true/false): whether the full analysis finished.

• intent_alignment: alignment signal between user purpose and observed

• misaligned: evidence suggests mismatch with user intent.
• no_mismatch_detected: no explicit mismatch signal detected.
• inconclusive: insufficient evidence to verify alignment.
• not_provided: no intent was provided.

Timing

Verifications typically take 30 to 90 seconds. Do not set short timeouts or abandon verification prematurely. Wait for the result before proceeding.

User-Facing Messaging

• Report the outcome clearly using agent_access_directive and

• Use confidence-aware language based on scan evidence (for example,

Tool Availability Fallback

If URLCheck tools are unavailable (including async/task variants), do not proceed with scan logic. Tell the user to install the plugin and restart the gateway.