首页龙虾技能列表 › OpenClaw RPA — 技能工具

OpenClaw RPA — 技能工具

v1.1.0

Record browser, Excel, Word & API actions once — replay without the LLM: faster, cheaper, no hallucinations. github.com/laziobird/openclaw-rpa . Supports com...

0· 0·0 当前·0 累计
by @laziobird·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/8
安全扫描
VirusTotal
无害
查看报告
OpenClaw
可疑
medium confidence
The skill's claimed purpose (record browser/API/Office actions and generate replayable Playwright scripts) matches the code and docs, but the runtime instructions encourage writing sensitive secrets (API keys and session cookies) into local files and generated scripts, which is a disproportionate risk and should be reviewed before installing.
评估建议
Before installing/using this skill, review these items and take mitigating steps: 1) Inspect rpa_manager.py and recorder_server.py (and any code that saves cookies or writes generated scripts) to confirm there is no unexpected network exfiltration; run them only after code review. 2) Never record or store cookies/API keys for high-value accounts; prefer test accounts. The skill will save cookies to ~/.openclaw/rpa/sessions and can embed API keys directly into generated .py files — avoid using th...
详细分析 ▾
用途与能力
Name/description (RPA recorder → Playwright scripts, browser/API/Excel/Word, cookie reuse) align with the included files (rpa_manager.py, recorder_server.py, templates, requirements). The set of Python dependencies and templates is appropriate for this functionality.
指令范围
The SKILL.md and auxiliary docs explicitly instruct the agent and recorder to save browser cookies to ~/.openclaw/rpa/sessions/... and to embed API keys directly into generated Python scripts when the user provides an `env` object in a record-step. Those instructions cause sensitive secrets to be written to disk and to generated artifacts that could be copied, committed, or exfiltrated. The recorder also modifies/creates files under the user's home directory and produces runnable .py scripts — all expected for an RPA tool but beyond a minimal skill's scope and requiring caution.
安装机制
There is no platform install spec in the registry, but the bundle includes requirements.txt and scripts/install.sh (virtualenv + pip + `playwright install chromium`). That is typical for Python projects; nothing in the provided manifest points to downloads from obscure hosts. Because no automatic install mechanism is enforced by the registry, installing will require running the included scripts locally — verify them before running.
凭证需求
The skill declares no required environment variables, yet its docs allow/encourage two sensitive flows: (1) cookies exported and stored in ~/.openclaw/rpa/sessions/<domain>/cookies.json for auto-login reuse, and (2) API keys placed into generated scripts when the `env` field is used in an `api_call` record-step. Both cause persistent storage of credentials on disk and increase blast radius if the machine or repository is shared. No external credential is strictly required by the skill manifest, but the runtime behavior can cause secrets to be persisted without additional safeguards.
持久化与权限
always:false (no forced global enable). The skill writes files into the user's home (~/.openclaw and rpa/ generated scripts) and updates a local registry.json of tasks; this is expected for a recorder but constitutes persistent data on the host. Agent autonomous invocation is permitted by default (not flagged alone).
recorder_server.py:234
Potential obfuscated payload detected.
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

🖥️ OSmacOS · Linux

版本

latestv1.1.02026/4/8
● 无害

安装命令 点击复制

官方npx clawhub@latest install openclaw-rpa
镜像加速npx clawhub@latest install openclaw-rpa --registry https://cn.clawhub-mirror.com

技能文档

GitHub: https://github.com/laziobird/openclaw-rpa — source, README, install, sample scripts under rpa/.

What this skill does

openclaw-rpa is an LLM-based RPA Agent framework. You describe a task in plain language; the AI executes it step by step in a real browser, on your computer, or via API services — with screenshot proof at every step — then compiles everything into a standalone Playwright Python script. Replay runs that script directly — no model call, no token burn, no hallucination risk — faster and cheaper than having the AI click every time.

Why this matters

  • Saves compute and money — Having a large model drive the browser on every run can cost roughly single-digit to tens of US dollars per heavy session (tokens, tools, long context). After you record once, repeat work does not call the model—replay is much faster and near-zero LLM cost for those steps.
  • Verify once, run the same way every time — During recording you confirm the flow works; later, replay executes the saved steps deterministically. You avoid asking the AI to “do it again” on every run, which hurts consistency and raises hallucination risk.

What you can automate (record once, replay many times — follow each site’s terms and local law):

CategoryExamples
BrowserLogin, navigate, click, fill forms, extract text, sort / filter tables
HTTP APIGET / POST any REST endpoint, save JSON, embed API keys directly in the script (#rpa-api)
Excel (.xlsx)Create / update workbooks, multiple sheets, headers, freeze panes, dynamic rows from JSON or another file
Word (.docx)Generate reports with paragraphs and tables — no Microsoft Office required
Auto-loginSave cookies once with #rpa-login, auto-inject on every recording and replay — skip OTP / CAPTCHA / QR-code flows
Mixed flowsAny combination above in a single recorded task (e.g. API + Excel + Word, or browser + login + extract)
Recorded example scripts (under rpa/): onlineshoppingv1.py e-commerce · yahoonew.py Yahoo Finance news · apiv3.py Alpha Vantage API (NVDA daily JSON, no browser) · reconciliationv2.py / 会计记账v2.py AP reconciliation (GET → Excel match → Word table report) — full write-up: EN · CN.

When to use

You want to…Send
Start recording a new flow#automation robot, #RPA, #rpa, or mention Playwright automation
See saved tasks you can run#rpa-list
Run a saved task (e.g. new chat)#rpa-run:{task name}
Run in this chatrun:{task name} (zh-CN: #run:{task-name})

Quick start (after install)

#rpa-list
#rpa-run:your-task-name

Full protocol, state machine, two-line signup (task name + capability A–G/N), deps-check / deps-install, record-step JSON, progressive probing, and selector strength (composite CSS — container + tag / attributes / :has(); avoid bare h3) live in the locale file below.

Output

Generated file is ordinary Python (rpa/.py) — runs standalone with python3, editable, no OpenClaw dependency at replay time.

Scope

Browsergoto, click, fill, select_option, scroll, wait, snapshot, extract_text, dom_inspect. HTTP APIapi_call (httpx GET/POST, key embedding, save_response_to); independent of the browser page. Local filesmerge_files (concatenate Desktop files); extract_text writes to disk; patch rpa/.py for folder / file ops after recording. Excel / Wordexcel_write (openpyxl, multi-sheet, dynamic rows from JSON or another file); word_write (python-docx, paragraphs + tables); no Microsoft apps required. Computed logicpython_snippet injects arbitrary Python into the generated script; executed and validated at record time. Out of scope — large ETL, databases, heavy OS automation.

Recommended sites

Good fits — predictable structure, works well out of the box:

CategoryExamples
Finance / dataYahoo Finance, investing.com
E-commerceSauce Demo (saucedemo.com), AliExpress, eBay
News / mediaBBC News, Reuters, Hacker News, Reddit listing pages
ReferenceWikipedia, GitHub public repo / issues pages
Not recommended — likely to break or require manual intervention:

SituationWhyWorkaround
Highly dynamic SPAs (heavy client-side routing)Selectors shift between renders; snapshots may miss contentUse dom_inspect + scroll to locate stable selectors
CAPTCHA / bot-detection (reCAPTCHA, hCaptcha)Automation blocked; human verification required
Login-gated flows (password / SMS OTP / slider / QR code)Credentials and 2FA must be handled manuallyUse #rpa-login to log in once manually → cookies saved automatically → #rpa-autologin injects them on every future recording and replay, skipping the login flow entirely
Tip: on a new site, start with goto + snapshot to confirm the page structure is readable before building a full flow.

Mandatory: load the correct instruction file

  • Read config.json in this skill directory. If it does not exist, read config.example.json (same shape; default locale is en-US).
  • Read the "locale" field. Allowed values: zh-CN and en-US (repository default in config.example.json: en-US).
  • Immediately use the Read tool to load the full skill body:
- zh-CNSKILL.zh-CN.md - en-USSKILL.en-US.md

  • Follow only that file for state machine, triggers, record-step JSON, onboarding text, and user-facing replies.
  • Reply to the user in the active locale’s language:
- zh-CN → Simplified Chinese for agent messages (user may still type English). - en-US → English for agent messages (user may still type Chinese).

Changing language

  • Copy config.example.jsonconfig.json if needed (python3 scripts/bootstrap_config.py), then edit "locale", or
  • Run: python3 scripts/set_locale.py en-US / python3 scripts/set_locale.py zh-CN (creates config.json from the example when missing).

After a locale change, the agent should re-read the matching SKILL.*.md in a new turn or session. See README.md in this directory for the full workflow.

ClawHub / discovery

  • SKILL.md (this file): short router + when to use + quick start for listings like ClawHub.
  • SKILL.zh-CN.md / SKILL.en-US.md: full onboarding, recording, RUN/LIST, and anti-timeout rules.
  • Scenario doc: articles/scenario-ap-reconciliation.en-US.md · CN — AP reconciliation (GET-only mock API, local Excel, Word table output).

Relative paths

When the loaded file references playwright-templates.md, synthesis-prompt.md, or rpa_manager.py, resolve paths relative to this skill directory (parent of SKILL.md).

数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制

了解定制服务