Agent skill · Audited from source

use-tinyfish

skill · tinyfish-io/tinyfish-cookbookMIT licenceAudited 20 Oct 2026 · source e8a4e98789fb

★ 2,263pushed 12 days ago
✓SAFEGrade B · 89/100 · 20 Oct 2026 · e8a4e98
2,263repo stars · whole tinyfish-io/tinyfish-cookbook

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit e8a4e98789fb and found no filesystem, network or shell access and no hard-coded secrets. What it does: Use TinyFish for web search, fetching URLs, reading pages, current information, source-backed answers, research, docs, pricing/product pages, extraction, scraping, and browser automation. Use whenever the user asks to…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “use-tinyfish (tinyfish-io/tinyfish-cookbook)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/tinyfish-io/use-tinyfish

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha e8a4e98789fb · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishertinyfish-io GitHub organizationOwner of the repository this skill is read from
  • Source foldertinyfish-io/tinyfish-cookbook/skills/use-tinyfishThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdicte8a4e98789fbA new audit runs when the source changes
  • Repository statusNot archivedLast push 12 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Use TinyFish for web search, fetching URLs, reading pages, current information, source-backed answers, research, docs, pricing/product pages, extraction, scraping, and browser automation. Use whenever the user asks to…

---
name: use-tinyfish
description: Use TinyFish for web search, fetching URLs, reading pages, current information, source-backed answers, research, docs, pricing/product pages, extraction, scraping, and browser automation. Use whenever the user asks to search, find, look up, research, compare, get information from the web, summarize a URL, fetch page content, or automate a website.
---

# TinyFish CLI

You have access to the TinyFish CLI (`tinyfish`) — a suite of web tools you can call from the terminal.

If not installed: `npm install -g @tiny-fish/cli`
If not authenticated: `tinyfish auth login --source openclaw` or set `TINYFISH_API_KEY` env var.

---

## When This Skill Should Trigger

Use TinyFish whenever a request depends on live web information or page content. Do not wait for the user to say "TinyFish" or "scrape".

Strong triggers include:

- Search or discovery: search, find, look up, research, compare, latest, current, news, docs, pricing, product details, best options.
- URL/page reading: fetch, read, summarize, extract from this page, inspect this URL, get the content, pull links or metadata.
- Source-backed answers: answer using web sources, verify a fact, check whether something changed, gather information from the web.
- Website work: interact with a site, click through pages, fill forms, log in, collect structured data, handle bot-protected pages.

Default to the lightest tool that can answer:

- No URL and the user needs web information: `search`, then `fetch` the best result(s) if more detail is needed.
- URL provided and only content is needed: `fetch`.
- Page interaction or dynamic extraction is needed: `agent`.
- Raw CDP/Playwright-style control is needed: `browser`.

---

## Picking the Right Tool

TinyFish has four tools. Start with the lightest one that can do the job and escalate only when needed.

```
search  →  fetch  →  agent  →  browser
lightest                        heaviest
```

| Tool | When to use | Speed | Cost |
|------|-------------|-------|------|
| **search** | You need to find URLs, current facts, docs, pricing, product details, or a quick source-backed answer | Fastest | Lowest |
| **fetch** | You have URLs and need clean page content, summaries, article text, docs, product pages, links, or metadata | Fast | Low |
| **agent** | You need to interact with a page — click, fill forms, navigate, extract structured data from dynamic sites | Slower | Higher |
| **browser** | Agent isn't enough — you need raw programmatic browser control via CDP | Slowest | Highest |

### Common Patterns

**Research: search → fetch**
Search for a topic, then fetch the best results to read their full content.

```bash
# 1. Find URLs
tinyfish search query "best React state management libraries 2026"

# 2. Read the top results
tinyfish fetch content get --format markdown "https://result1.com" "https://result2.com"
```

**Deep extraction: search → agent**
Search to find the right site, then use agent to interact with it and extract structured data.

```bash
# 1. Find the site
tinyfish search query "Nike running shoes official store"

# 2. Automate extraction on it
tinyfish agent run --url "https://nike.com/running" \
  "Extract all running shoes as JSON: [{\"name\": str, \"price\": str, \"colors\": [str]}]"
```

**Escalation: fetch → agent**
Try fetch first. If the page is dynamic/JS-heavy and fetch returns empty or incomplete content, escalate to agent.

**Full control: agent → browser**
If agent can't handle a complex multi-step workflow, spin up a raw browser session and automate it yourself via CDP.

---

## Commands

### `tinyfish search query`

Web search. Returns ranked results with titles, URLs, and snippets.

```bash
tinyfish search query "<query>" [--location <hint>] [--language <hint>] [--pretty]
```

- Returns 10 results by default
- Use `--location` and `--language` for geo-targeted results
- Default output is JSON; `--pretty` for human-readable

```bash
tinyfish search query "best pho in Ho Chi Minh City" --location "Vietnam" --language "en"
```

---

### `tinyfish fetch content get`

Fetch clean, extracted content from one or more URLs. Strips ads, nav, boilerplate — returns just the content.

```bash
tinyfish fetch content get <urls...> [--format markdown|html|json] [--links] [--image-links] [--pretty]
```

- Accepts **multiple URLs** in a single call — they are fetched in parallel server-side
- `--format markdown` (default) — clean readable text
- `--format json` — structured document tree
- `--links` — include all extracted links from the page
- `--image-links` — include extracted image URLs
- Response includes: `url`, `final_url`, `title`, `language`, `author`, `published_date`, `text`, `latency_ms`

```bash
# Fetch one page as markdown
tinyfish fetch content get --format markdown "https://example.com/article"

# Fetch multiple pages with links
tinyfish fetch content get --links "https://site-a.com" "https://site-b.com" "https://site-c.com"
```

---

### `tinyfish agent run`

Run a browser automation using a natural language goal. The agent opens a real browser, navigates, clicks, fills forms, and extracts data.

```bash
tinyfish agent run --url <url> "<goal>" [--sync] [--async] [--pretty]
```

| Flag | Purpose |
|------|---------|
| `--url <url>` | Target URL (bare hostnames get `https://` auto-prepended) |
| `--sync` | Wait for full result without streaming steps |
| `--async` | Submit and return immediately |
| `--pretty` | Human-readable output |

**Output:** Default streams `data: {...}` SSE lines. The final result is the event where `type == "COMPLETE"` and `status == "COMPLETED"` — the extracted data is in the `resultJson` field. Read the raw output directly; no script-side parsing is needed.

**Always specify the JSON structure you want in the goal:**

```bash
tinyfish agent run --url "https://example.com/products" \
  "Extract all products as JSON array: [{\"name\": str, \"price\": str, \"url\": str}]"

tinyfish agent run --url "https://example.

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit e8a4e98

Download folder ↗
git clone https://github.com/tinyfish-io/tinyfish-cookbook
git -C tinyfish-cookbook checkout e8a4e98789fb

The author documents no install command, so this uses the repository directly. Our verdict covers commit e8a4e98789fb only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source e8a4e98789fb

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/tinyfish-io/use-tinyfish/badge.svg)](https://modelsatlas.com/skills/tinyfish-io/use-tinyfish/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

image-generation✓SAFE

bytedance/deer-flow

Use this skill when the user requests to generate, create, imagine, or visualize images including characters, scenes, products, or any visual content. Supports structured prompts and reference images for guided…

★ 85kGrade B
newsletter-generation✓SAFE

bytedance/deer-flow

Use this skill when the user requests to generate, create, write, or draft a newsletter, email digest, weekly roundup, industry briefing, or curated content summary. Supports topic-based research, content curation from…

★ 85kGrade B
github-deep-research✓SAFE

bytedance/deer-flow

Conduct multi-round deep research on any GitHub Repo. Use when users request comprehensive analysis, timeline reconstruction, competitive analysis, or in-depth investigation of GitHub. Produces structured markdown…

★ 85kGrade B
frontend-design✓SAFE

bytedance/deer-flow

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites,…

★ 85kGrade B
find-skills✓SAFE

bytedance/deer-flow

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used…

★ 85kGrade B
deep-research✓SAFE

bytedance/deer-flow

Use this skill instead of WebSearch for ANY question requiring web research. Trigger on queries like "what is X", "explain X", "compare X and Y", "research X", or before content generation tasks. Provides systematic…

★ 84kGrade B

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/tinyfish-io/use-tinyfish/badge.svg)](https://modelsatlas.com/skills/tinyfish-io/use-tinyfish/)

Questions about use-tinyfish

What does the use-tinyfish skill do?
A collection of sample apps and recipes built with the TinyFish web agent. Open-source examples for you to learn & build!
Is use-tinyfish safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can use-tinyfish access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
What do I need installed to use use-tinyfish?
Its own instructions reference fetch and search. Dependencies are pinned to exact versions.
Which assistants does use-tinyfish work with?
Its documentation mentions openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (e8a4e98789fb), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.