by 安全扫描
OpenClaw
可疑
medium confidenceThe skill is broadly what it claims (a Tampermonkey userscript for a local WebChat) but the provided install instructions and assets contain inconsistencies and a risky 'curl | bash' install pattern (including a short URL in another copy of the command) that are disproportionate to a simple userscript.
评估建议
This package looks like a normal Tampermonkey userscript for a local WebChat, but there are red flags around the installation instructions. Do not run curl | bash on an unfamiliar URL without inspecting the script first. Prefer one of these safer approaches: 1) Install via GreasyFork (open the GreasyFork page from SKILL.md and confirm the script there), or 2) Manually copy the included enhancer.user.js into Tampermonkey's 'Create new script' and inspect it before saving. Avoid using the bit.ly s...详细分析 ▾
ℹ 用途与能力
The code files are Tampermonkey userscripts that target http://127.0.0.1:18789 and manipulate the WebChat DOM — this matches the skill description. However the repository also includes an install.sh that runs a 'clawhub install' command and the HTML includes a curl|bash command; these installer actions are not strictly required to install a client-side userscript and are therefore disproportionate convenience steps.
⚠ 指令范围
SKILL.md and the HTML instruct the user to run a one-line 'curl -sL <URL> | bash' to install. The userscript itself runs only in the browser and manipulates page DOM, which is expected, but the runtime instructions ask the user to execute remote shell code — an operation outside the skill's stated browser-only scope. There is also an inconsistent command shown in index.html using a bit.ly shortener instead of the raw GitHub URL in SKILL.md, which hides the final destination.
⚠ 安装机制
There is no formal install specification, but SKILL.md and index.html promote piping a remote script to bash (raw.githubusercontent.com in SKILL.md, a bit.ly short link in index.html). Piping remote scripts to a shell is high-risk. The included install.sh itself is benign-looking (it calls 'clawhub install' and opens the GreasyFork page) but calling 'clawhub' is unnecessary for adding a Tampermonkey script and could have side effects depending on the user's environment. The presence of a URL shortener increases risk because it obscures the destination.
✓ 凭证需求
The skill does not request environment variables, credentials, or config paths. The userscripts appear to operate entirely in-browser on the local WebChat page and do not include outbound network requests in the visible code snippets.
✓ 持久化与权限
The skill does not request 'always: true' and does not modify other skills or system-wide configurations in the inspected files. It relies on Tampermonkey (a browser extension) for persistence, which is expected for a userscript.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv4.5.22026/3/26
docs: update SKILL.md - hover nav, auto theme, no settings/language switching
● 无害
安装命令 点击复制
官方npx clawhub@latest install webchat-enhancer
镜像加速npx clawhub@latest install webchat-enhancer --registry https://cn.clawhub-mirror.com
技能文档
🌟 Hover-expandable navigation for OpenClaw WebChat | Auto Theme Sync | Lobster Colors
⚡ One-Command Install
curl -sL https://raw.githubusercontent.com/yjin94606-art/webchat-enhancer/main/skills/webchat-enhancer/install.sh | bash
Install Tampermonkey
Chrome / Edge:
- Install Tampermonkey
- Enable Developer Mode: Open
chrome://extensions/→ Toggle Developer Mode ON - Reload Tampermonkey if needed
Firefox / Safari: Just install Tampermonkey directly
Install Script
Option 1: GreasyFork (Recommended)
open "https://greasyfork.org/scripts/571337-webchat-enhancer"
Option 2: Manual
- Download: enhancer.user.js
- Open Tampermonkey Dashboard → Create new script → Paste & Save
Open WebChat
http://127.0.0.1:18789
Navigation panel appears automatically! ✅
Features
| Feature | Description |
|---|---|
| 🖱️ Hover to Expand | Panel slides out when mouse approaches, hides when mouse leaves |
| 🎨 Auto Theme Sync | Automatically matches WebChat Dark/Light mode |
| 🦐 Lobster Colors | Crimson red accent inspired by OpenClaw's branding |
| 📜 Chat Navigator | Click any card to jump to that message |
| 🔄 Auto-Updating | Detects new messages automatically |
| ⚡ Zero Config | Works out of the box — no settings needed |
Usage
| Action | Effect |
|---|---|
| Mouse enters right edge tab | Navigator slides out |
| Mouse leaves navigator | Navigator slides back in |
| Click any message card | Smooth scroll to that message |
| Click Refresh | Rescan conversation |
What Changed in 4.5.0
- ❌ Removed language switching — English only
- ❌ Removed theme selector — fully automatic
- ❌ Removed settings panel
- 🆕 Hover-expandable navigation
- 🆕 Auto theme detection
Browser Support
Chrome · Firefox · Edge · Safari
Requires Tampermonkey extension.
Links
- 🌐 ClawHub
- 📦 GreasyFork
- 💻 GitHub
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制