by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's inputs and tooling match a Puppeteer automation helper, but the runtime instructions encourage autonomous installs and persistent local storage without explicit user consent, which is unexpected and worth caution.
评估建议
This skill is functionally consistent with a Puppeteer helper, but pay attention before enabling it: it instructs the agent to create ~/puppeteer/, persist a memory file there, and run `npm install` if Puppeteer isn't present — and the docs say to do this 'without asking.' Before installing/use, confirm you are comfortable with the agent writing to your home directory and performing network package installs. Prefer running it in a sandbox or VM, review any generated scripts in ~/puppeteer/script...详细分析 ▾
✓ 用途与能力
Name/description align with required binary (node) and the instructions (Puppeteer usage, selectors, waiting patterns). Creating ~/puppeteer/ for scripts and outputs is coherent for a browser-automation skill.
⚠ 指令范围
SKILL.md and setup.md instruct the agent to run npm install (network fetch) and create/write files under ~/puppeteer/; they also say 'Don't ask — just start naturally' and 'Store in ~/puppeteer/memory.md without mentioning file paths to them.' Those directives push the agent to act autonomously, install packages, and persist memory without explicit user confirmation or transparency about what is stored.
ℹ 安装机制
There is no formal install spec (instruction-only), which reduces installer-level risk. However setup.md tells the agent to run `npm install puppeteer` or `puppeteer-core` if missing — a normal but network-dependent action that will fetch code from npm. This is expected for Puppeteer but should be performed with user consent.
✓ 凭证需求
The skill declares no required environment variables or credentials. Mention of 'you provide them per-script' (credentials) is reasonable for site-specific tasks and not requested globally. No unrelated secrets are requested.
⚠ 持久化与权限
The skill intentionally writes persistent state to the user's home directory (~/puppeteer/) and may install npm packages. While that fits the skill's purpose, the combination of persistent storage plus explicit instruction to proceed without asking increases risk: unexpected file creation, long-lived local state, and network installs could occur without clear user approval.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSLinux · macOS · Windows
版本
latestv1.0.02026/3/25
Initial release of Puppeteer skill for browser automation. - Provides setup and architecture guidance for automating Chrome/Chromium with Puppeteer. - Includes best practice rules for selectors, waiting, navigation, viewport, popups, error handling, and rate limiting. - Details common pitfalls and troubleshooting tips for scraping and testing workflows. - Ensures local-only data storage for privacy and security. - Lists related skills and ways to provide feedback.
● 无害
安装命令 点击复制
官方npx clawhub@latest install puppeteer-1-0-0
镜像加速npx clawhub@latest install puppeteer-1-0-0 --registry https://cn.clawhub-mirror.com
技能文档
Setup
On first use, read setup.md for integration guidelines.
当...时 到 使用
User needs browser automation: web scraping, E2E testing, PDF generation, screenshots, or any headless Chrome task. Agent handles page navigation, element interaction, waiting strategies, and data extraction.
Architecture
Scripts and outputs in ~/puppeteer/. See memory-template.md for structure.
~/puppeteer/
├── memory.md # Status + preferences
├── scripts/ # Reusable automation scripts
└── output/ # Screenshots, PDFs, scraped data
Quick Reference
| Topic | File |
|---|---|
| Setup process | setup.md |
| Memory template | memory-template.md |
| Selectors guide | selectors.md |
| Waiting patterns | waiting.md |
Core Rules
1. Always Wait 之前 Acting
Never click or type immediately after navigation. Always wait for the element:await page.waitForSelector('#button');
await page.click('#button');
2. 使用 Specific Selectors
Prefer stable selectors in this order:[data-testid="submit"]— test attributes (最多 stable)#unique-id— IDs表单 按钮[类型="submit"]— semantic combinations.类-name— classes (最少 stable, changes often)
Avoid: div > div > div > button — breaks on any DOM change.
3. Handle 导航 Explicitly
After clicks that navigate, wait for navigation:await Promise.all([
page.waitForNavigation(),
page.click('a.next-page')
]);
4. 设置 Realistic Viewport
Always set viewport for consistent rendering:await page.setViewport({ width: 1280, height: 800 });
5. Handle Popups 和 Dialogs
Dismiss dialogs before they block interaction:page.on('dialog', async dialog => {
await dialog.dismiss(); // or dialog.accept()
});
6. 关闭 Browser 在...上 Errors
Always wrap in try/finally:const browser = await puppeteer.launch();
try {
// ... automation code
} finally {
await browser.close();
}
7. Respect Rate Limits
Add delays between requests to avoid blocks:await page.waitForTimeout(1000 + Math.random() * 2000);
Common Traps
page.click()在...上 invisible 元素 → fails silently, 使用waitForSelector带有visible: 真- Screenshots 的 elements off-screen → blank image, scroll 进入 视图 第一个
page.evaluate()returns 未定义 → cannot return DOM nodes, 仅 serializable data- Headless blocked 由 site → 使用
headless: '新的'或 设置 用户 agent - 表单 submit reloads page →
page.waitForNavigation()或 data lost - Shadow DOM elements invisible 到 selectors → 使用
page.evaluateHandle()到 pierce shadow roots - Cookies 不 persisting → launch 带有
userDataDir对于 会话 persistence
Security & Privacy
Data stays local:
- 所有 scraped data 在...中 ~/puppeteer/输出/
- Browser 个人资料 在...中 specified userDataDir
skill 做 不:
- 发送 scraped data anywhere
- Store credentials (您 provide them per-script)
- Access files outside ~/puppeteer/
Related Skills
Install withclawhub install if user confirms:
playwright— Cross-browser automation alternativechrome— Chrome DevTools 和 debuggingweb— General web development
Feedback
- 如果 useful:
clawhub star puppeteer - Stay updated:
clawhub 同步
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制