📦 browser-automation — 技能工具
v1.0.0Automate web browser interactions using natural language via CLI commands. Use when the user asks to browse websites, navigate web pages, extract data from w...
0· 22·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
high confidenceThe skill mostly matches a browser-automation purpose but has clear inconsistencies and behaviors that could expose sensitive data (remote API routing, persistent browser profile, global npm linking), so review and caution are advised before installing.
评估建议
This skill appears to do real browser automation but has several red flags. Before installing or running it: (1) confirm the registry metadata vs SKILL.md inconsistency for SKILLBOSS_API_KEY — ask the author whether remote mode is optional and what data is sent to the SkillBoss API Hub; (2) avoid adding your real credentials or visiting sensitive accounts while testing — the skill preserves a Chrome profile and may upload page content to a third-party model; (3) be cautious running 'npm link' be...详细分析 ▾
⚠ 用途与能力
The declared purpose (browser automation) matches the instructions (CLI commands to navigate, act, extract, screenshot, etc.). However the package metadata claims no required env vars while SKILL.md and setup.json reference SKILLBOSS_API_KEY; that metadata mismatch is incoherent. The skill also expects Chrome and a globally linked 'browser' CLI which is reasonable for a CLI tool but may be disproportionate if a lightweight instruction-only adapter was intended.
⚠ 指令范围
SKILL.md tells the agent/user to run npm install and npm link (writes to disk and creates a global binary), to launch Chrome with a persistent profile (.chrome-profile) and remote debugging, and to route AI-driven actions via SkillBoss API Hub. Those instructions enable persistent storage of cookies/sessions and automatic downloads to ./agent/downloads, and they imply that page content and extracted data may be sent to an external model API. The automatic mode selection 'no user prompting' (local vs remote) and lack of clarity about what page data is transmitted are scope/privilege concerns.
ℹ 安装机制
There is no registry install spec (skill is instruction-only), but SKILL.md instructs the user to run 'npm install' and 'npm link' in the skill directory. That requires building artifacts locally and will create a global 'browser' command which can override existing binaries — a benign action for a CLI but worth flagging because it changes system state and can shadow other tools.
⚠ 凭证需求
The skill references SKILLBOSS_API_KEY (frontmatter and setup.json) even though registry metadata lists no required env vars, an inconsistency. Using a third‑party API hub for AI-driven element selection/extraction implies that scraped page content (possibly including form fields, screenshots, and cookies) could be sent to that external service — a high-impact data flow that must be justified and consented to. The skill recommends storing the API key in .env or exporting it globally, which increases risk if the remote service receives sensitive page data.
ℹ 持久化与权限
The skill uses a persistent Chrome profile (.chrome-profile) and a downloads directory (./agent/downloads), which intentionally preserves session cookies and downloaded files between runs. 'always' is false and the skill does not request system-wide config changes beyond creating a global CLI via npm link, but persistent browser state plus remote routing increases the chance of leaking long-lived credentials or session cookies.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/14
Initial release of browser automation skill. - Automate web browser interactions via natural language CLI commands - Supports both local browser and remote SkillBoss API Hub modes with automatic environment selection - Includes commands for navigation, actions, data extraction, element discovery, screenshots, and browser control - Provides setup, troubleshooting, and usage best practices guidance
● 可疑
安装命令
点击复制官方npx clawhub@latest install toby-browser-automation
镜像加速npx clawhub@latest install toby-browser-automation --registry https://cn.longxiaskill.com