Drission Sota Toolkit

This package contains powerful local-browser and relay tools (CDP takeover, driver injection, local TCP/UDS relay) that can execute arbitrary JavaScript inside a browser and forward local traffic. Key concerns: (1) Manifest/instruction mismatches — _meta.json claims a minimal scraper while the code implements high-risk 'nuclear' features; SKILL.md and registry disagree on disable-model-invocation. (2) Undeclared use of environment/config — code expects SOTA_NUCLEAR_CONFIRMED and a lockfile at ~/.openclaw/tmp/sota_active.lock and creates /tmp sockets, but the manifest declares no env vars or config paths. (3) High-privilege operations — Runtime.evaluate via CDP and direct BrowserDriver injection are capable of executing arbitrary payloads in the browser context and interacting with local services. Recommended actions before installing or enabling this skill: run only in an isolated VM/container; require the author to fix manifest and metadata inconsistencies (version, disable-model-invocation, declared bins/python deps, declared config paths and env vars); remove or explicitly justify 'nuclear' scripts if not needed; review and possibly delete/disable scripts that perform CDP takeover or direct driver injection; and confirm ownership/provenance of the package. If you need to trust this skill on a host, obtain explicit answers from the author about gating guarantees and demonstrable proof that the UDS/lockfile gating cannot be trivially bypassed. Additional information that would raise confidence: an updated _meta.json matching the code (including required python deps and config paths), confirmation that disable-model-invocation is enforced at registry/platform level, and documentation/tests proving the gating can't be bypassed.