ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Chrome Devtools Mcp

v1.0.0

Chrome DevTools MCP — Google's official browser automation and testing server. Control Chrome via Puppeteer through MCP protocol: click, fill forms, navigate...

⭐ 2· 2.2k·30 current·32 all-time
by@aiwithabidi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name/description (Chrome DevTools MCP) aligns with the declared requirements and instructions: Node.js and Chrome/Chromium are the expected dependencies, and the SKILL.md and setup script all center on starting/configuring the MCP server. No unrelated credentials, binaries, or system paths are requested.
✓
Instruction Scope
SKILL.md describes only browser automation operations and how to start the MCP server. The included setup script checks for node/npx/Chrome, pre-caches the npm package, prints an openclaw.json snippet, checks ~/.openclaw/openclaw.json for configuration, and can start a headless MCP server for a quick test. It does not attempt to read unrelated files or request secrets.
ℹ
Install Mechanism
There is no formal install spec; instructions rely on npx to fetch and run chrome-devtools-mcp@latest from the npm registry. Using npx @latest is a normal way to run CLI tools but means remote code is fetched at runtime (unpinned). This is a supply-chain risk: if the npm package is compromised or a different package is published under the same name, arbitrary code could run. The package homepage points to an official ChromeDevTools repo, which mitigates concern but does not eliminate the live-download risk.
✓
Credentials
The skill requests no environment variables, no credentials, and only references a local config path (~/.openclaw/openclaw.json) for verifying/printing MCP config. The setup script's accesses are proportional to its stated purpose (setup/status/test).
✓
Persistence & Privilege
The skill is not always-enabled, does not request elevated privileges, and does not modify other skills or system-wide settings. The setup script prints configuration for openclaw.json but does not write to system files by itself. The test command launches an MCP server process (expected behavior).
Assessment
This skill appears to do what it says: start and test a Chrome DevTools MCP server via the chrome-devtools-mcp npm package. Before installing or enabling it, consider: 1) npx -y chrome-devtools-mcp@latest fetches and runs code from the npm registry at runtime — pin a specific version (not @latest) if you want reproducibility and lower supply-chain risk. 2) The MCP server can control a browser and access any page you visit; avoid exposing sensitive pages or credentials to automated sessions. 3) The SKILL.md documents telemetry (Google usage statistics / CrUX) and provides flags to disable them — use those flags if you want to avoid sending traces. 4) If you need higher assurance, review the npm package and its GitHub repo (homepage) and run the setup/test commands in an isolated environment first.

Like a lobster shell, security has layers — review code before you run it.

latestvk973mnsmg14hrgfktvz1nwpmdn81jm0g

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🌐 Clawdis

Comments