by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill runs JavaScript inside the target page (via Chrome DevTools) to collect performance data and attribute blocking to scripts. It does not contact external servers or ask for credentials. Before running: 1) Only execute on pages you trust or on staging environments, since the snippets can read DOM and script URLs. 2) Expect the snippets to leave PerformanceObservers and window helper functions active; reload the page to remove them or call provided clear/export functions where available....详细分析 ▾
✓ 用途与能力
Name/description match the bundled scripts: all files are DevTools snippets that use the Performance API and provide INP, LoAF, long-task, CLS, and scroll analyses. Nothing requests unrelated cloud credentials, binaries, or system access.
ℹ 指令范围
SKILL.md instructs the agent to evaluate scripts via the Chrome DevTools MCP and capture console output — which is exactly what the scripts do. The scripts read the DOM, Performance entries, and script URLs (to attribute third-party vs first-party), and they expose window.getXxx() functions and set up PerformanceObserver tracking. This is appropriate for the stated purpose but does grant the skill broad read access to page DOM and performance entries.
✓ 安装机制
No install spec; this is instruction + snippet files only. Nothing is downloaded or executed outside the browser context.
ℹ 凭证需求
The skill requires no environment variables or external credentials. It does read page-local information (DOM, element attributes, performance entries, script source URLs) — this is necessary for attribution and debugging, but it means the snippets can observe page content and script origins.
ℹ 持久化与权限
The scripts create persistent observers and attach helper functions to window (e.g., getInteractionSummary, getLoAFSummary). One snippet monkeypatches EventTarget.prototype.addEventListener to detect non-passive listeners — that is intrusive and can interfere with page code while active. Observers and monkeypatches persist until the page reloads or the scripts provide explicit clear functions (some do). There is no platform-level 'always' privilege requested.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install webperf-interaction
镜像加速npx clawhub@latest install webperf-interaction --registry https://cn.longxiaskill.com