📦 Lightpanda browser — 轻量无头浏览器
v1.0.3Lightpanda browser 是 Chrome 与 Openclaw 的即插即用替代品，专为无图形渲染的数据抓取等任务设计，体积更小、速度更快，可无缝对接 Playwright、Puppeteer 等 CDP 客户端。
3· 2.2k·4 当前·5 累计
by 下载技能包
最后更新
2026/4/23
安全扫描
OpenClaw
安全
high confidenceThe skill's description, runtime instructions, and install script are internally consistent: it installs a headless browser binary from a GitHub releases URL and instructs the agent to connect to its local CDP endpoint; nothing in the package asks for unrelated credentials or system access.
评估建议
The skill appears coherent with its stated purpose, but before installing consider: (1) The installer fetches and executes a nightly binary from GitHub releases — nightly builds are unvetted and could contain bugs or malicious changes. Only proceed if you trust the lightpanda-io project; review the upstream GitHub repository and recent release notes/commit history. (2) The script verifies a SHA256 digest obtained from the GitHub API; verify the repository and asset yourself if possible. (3) The ...详细分析 ▾
✓ 用途与能力
Name and description (headless CDP browser for data extraction) match the included SKILL.md and the install script which downloads a Lightpanda binary and instructs how to run a CDP server. There are no environment variables or credentials requested that would be unrelated to a browser.
✓ 指令范围
SKILL.md stays on-topic: it tells the agent how to install, start, and connect to a local CDP endpoint and how to use Playwright/Puppeteer. It does not instruct reading unrelated files, exfiltrating data, or contacting unexpected external endpoints beyond GitHub (for install/checksum) and web targets that the user browses.
ℹ 安装机制
Install script downloads a nightly binary directly from GitHub releases (well-known host) to $HOME/.local/bin and verifies a SHA256 digest fetched from the GitHub releases API. This is a reasonable, common pattern, but downloading and executing an unvetted nightly binary carries inherent risk. The script's reliance on an asset '.digest' field may be fragile (if absent, install aborts). Requires curl, jq, and sha256sum/shasum.
✓ 凭证需求
No credentials or sensitive environment variables are requested. The only optional env observed is LIGHTPANDA_DIR to override the install directory — appropriate for an installer. The runtime uses a localhost port for CDP; no external auth or tokens are required by the skill itself.
✓ 持久化与权限
Skill is instruction-only (plus an install script) and does not request 'always: true'. It installs a user-local binary (no system-wide privilege escalation) and does not modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/2/6
- Add checksum verification to install script
● 可疑
安装命令
点击复制官方npx clawhub@latest install lightpanda-browser
镜像加速npx clawhub@latest install lightpanda-browser --registry https://cn.longxiaskill.com