Surfagent Perception
v1.0.0Agent vision for web pages — scene summaries, attention-ranked elements, annotated screenshots, and state diffing via SurfAgent's perception engine.
⭐ 0· 32·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md consistently describes a perception engine that runs as a local SurfAgent daemon (port 7201) backed by a managed Chrome instance (port 9222). The described tools (surf_perceive, surf_annotate, surf_scene_diff) and their outputs (scene summaries, annotated screenshots, state tokens) align with the skill's name and description.
Instruction Scope
Instructions are limited to calling a local SurfAgent service to capture DOM, annotated screenshots, and diffs. They do not ask to read arbitrary files or unrelated environment variables. Important operational detail: the agent is expected to connect to localhost:7201 and interact with Chrome (CDP), which can capture page content including any sensitive information displayed on pages (passwords, auth tokens, personal data). The SKILL.md does not describe any redaction or privacy safeguards.
Install Mechanism
No install spec and no code files — this is instruction-only, so nothing gets written to disk by the skill itself. That is the lowest install risk.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. One minor inconsistency: SKILL.md metadata lists 'node' as a required binary even though the instructions talk only to a local SurfAgent daemon (HTTP + Chrome). Requiring 'node' may be unnecessary or a packaging artifact; it does not appear to grant extra access, but it is an unexplained dependency.
Persistence & Privilege
The skill does not request always:true and is user-invocable. Autonomous invocation (default) is allowed, which is expected for skills. Note: autonomous use combined with the ability to control a local browser has a substantial operational privilege (it can observe and interact with pages), but that is coherent with the skill's purpose.
Assessment
This skill is instruction-only and expects a local SurfAgent daemon (localhost:7201) and a managed Chrome (9222). Before installing: (1) verify you trust the SurfAgent daemon you run locally — the skill will capture full page DOM and screenshots which can include sensitive data; (2) confirm why 'node' is declared as a required binary if you don't have a node-based SurfAgent client — it may be a packaging artifact; (3) run SurfAgent in an isolated environment if you plan to visit sensitive sites, and avoid giving the agent access to pages with credentials or personal data unless you understand redaction behavior; (4) if you need higher assurance, ask the publisher for source code or a specification of the protocol (endpoints, authentication, and data retention) and confirm the homepage/service is legitimate.Like a lobster shell, security has layers — review code before you run it.
latestvk975837b33m8mbpk897166kzvd844sx2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
👁️ Clawdis
Binsnode