Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
E2E Test Recorder
v1.0.0Records browser interactions for end-to-end tests and generates videos or GIFs with configurable encoding and annotations.
⭐ 0· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose (browser/E2E recording and video/GIF generation) matches most files (record-*, examples, SKILL.md). However there are several maintenance/CI/release scripts (scripts/auto-release.js, scripts/github-api-release.js, deploy/release docs) that perform repository operations, create releases, and attempt to read a configuration file outside the project. Those publishing/automation responsibilities are not needed for a runtime recording skill and are disproportionate to the stated purpose.
Instruction Scope
SKILL.md only documents recording usage and config. It does not warn that included scripts will read files outside the project or attempt to push code/release to GitHub. The codebase contains instructions (in scripts/auto-release.js) to load ../config.yaml and to perform git push, tag, and release steps. If run by an agent or user in an environment containing secrets in parent directories, these scripts could access/use them despite SKILL.md focusing on recording.
Install Mechanism
There is no install spec in the skill registry entry (instruction-only). The package.json lists standard Node dependencies (puppeteer, ffmpeg-static, etc.) which are appropriate for recording functionality. No downloads from untrusted URLs or archive extraction steps are present in the provided manifests.
Credentials
The skill declares no required environment variables or credentials, but scripts/auto-release.js and related release tooling expect a GitHub token in a config file (../config.yaml) and will set process.env.GITHUB_TOKEN and run git commands. That is an undeclared request for sensitive credentials and therefore disproportionate to the recording purpose.
Persistence & Privilege
Skill flags show no elevated privileges (always: false). The code does perform Git operations (push, tag) and writes release/guide files to disk when release scripts are run — these are repository-modifying actions but only occur if the release scripts are executed. This is not an automatic persistence/always-loaded privilege, but it increases blast radius if the release scripts are invoked by an automated agent without review.
What to consider before installing
This package appears to be a genuine E2E recording tool, but it includes release/publishing scripts that access a ../config.yaml for a GitHub token and run git push/tag/release steps. Before installing or running anything: 1) Inspect scripts/auto-release.js and scripts/github-api-release.js and do not run them unless you intend to publish — they may read credentials from parent directories. 2) Ensure there is no sensitive config.yaml (or other credential files) in parent directories that these scripts could read. 3) Run the recorder code (examples, CLI record/test commands) in an isolated environment or container the first time. 4) If you only need recording, consider removing or ignoring the release/CI scripts from the package (or run npm install and then delete/rename the scripts) so automated agents can't execute them. 5) If you want to allow publishing automation, review exactly where credentials must be stored and prefer explicit environment variables or a dedicated CI secret store rather than a config file located outside the project. If you want me to, I can inspect the remaining omitted script files (github-api-release.js, record-browser.js, record-test.js, utils.js, etc.) for other surprises — provide their contents and I'll analyze them.scripts/auto-release.js:45
Shell command execution detected (child_process).
scripts/deploy.js:23
Shell command execution detected (child_process).
scripts/github-api-release.js:162
Shell command execution detected (child_process).
simple-test.js:55
Shell command execution detected (child_process).
scripts/utils.js:316
Dynamic code execution detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk9774t9bksa4zrhs492p3vrmvd84q2w3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.