Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
webcli
v0.2.1Browse the web, read page content, click buttons, fill forms, take screenshots, and get accessibility snapshots using the webcli headless browser. Use when t...
⭐ 0· 670·0 current·0 all-time
byErdinç Cürebal@erdinccurebal
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (web browsing, clicking, filling forms, screenshots, accessibility snapshots) align with the SKILL.md commands and examples. The prerequisite npm package and Playwright browser install are expected for a CLI headless browser.
Instruction Scope
Instructions focus on web navigation and interaction, which is in‑scope. They also include state/cookie export, localStorage access, file upload, and saving/restoring session.json — these are required for realistic browser automation but can expose site sessions or user files if misused.
Install Mechanism
There is no registry install spec; the SKILL.md tells users to run 'npm install -g @erdinccurebal/webcli' and 'npx playwright install chromium'. Using an npm-scoped package and Playwright is normal for this tool, but it does mean executing third‑party code and downloading browser binaries from the network (supply-chain risk).
Credentials
The skill declares no required environment variables or config paths. However, its functionality (cookies, localStorage, state export, file upload) can capture or persist sensitive data from sites visited; this is functionally necessary but worth noting from a privacy/credential exposure perspective.
Persistence & Privilege
The skill does not request always:true, system config changes, or other skills' credentials. It is instruction-only and does not demand persistent platform privileges. Autonomous invocation is enabled by default (normal), so consider agent policies that control which URLs or actions the agent may perform.
Assessment
This skill appears internally consistent for headless browser automation. Before installing or running it: (1) review and trust the npm package and its GitHub repo (supply‑chain risk); (2) run the tool in a sandbox or isolated environment if possible; (3) avoid directing the agent to log into or visit pages containing highly sensitive data unless you trust the agent and skill, because cookies/localStorage/session exports could leak credentials; (4) be aware the prerequisites will download browser binaries (Playwright) and install a global npm package — only proceed if you trust those sources.Like a lobster shell, security has layers — review code before you run it.
latestvk97eksw4w6b85cad84s4ee0cwn81q0dz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.