by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill is coherent with its stated purpose but has real operational impact: it requires installing OS packages (apt-get) and pip dependencies and will spawn Xvfb and a real Chromium process and then simulate mouse/keyboard input. Before installing/running, consider: 1) install and run inside an isolated environment (container or dedicated VM) so simulated input and browser sessions cannot interact with sensitive local apps; 2) be aware the agent can type/click arbitrarily in that virtual bro...详细分析 ▾
✓ 用途与能力
Name/description (virtual desktop browser to simulate human GUI actions) matches the included code and SKILL.md. The Python code spawns Xvfb and chromium-browser and uses PyAutoGUI/OpenCV for clicks, typing, screenshots and template matching — all expected for the stated purpose.
ℹ 指令范围
SKILL.md instructs installing system packages (apt-get) and pip dependencies, and the code writes a small state file under ~/.cache/virtual-desktop-browser/state.json. The install/run instructions and runtime operations (starting processes, moving mouse, typing, capturing screenshots) are within scope for GUI automation, but they do require OS-level package installs and will perform arbitrary input actions in the launched browser session (i.e., the agent can type/click any text or interact with pages).
ℹ 安装机制
No automated install spec is bundled (instruction-only install). SKILL.md recommends apt-get and pip commands — these are common for this functionality but require privileged/system changes and network access to package repositories. No downloads from unfamiliar URLs or extract operations are present in the bundle itself.
✓ 凭证需求
The skill requests no environment variables, no credentials, and no external configuration paths beyond writing its own state in the user's home cache. That is proportionate to its stated function.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or global agent configuration. It persists minimal state in ~/.cache/virtual-desktop-browser/state.json (display and PIDs) which is reasonable for lifecycle management.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/14
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install virtual-desktop-browser
镜像加速npx clawhub@latest install virtual-desktop-browser --registry https://cn.longxiaskill.com