Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Web Autopilot
v1.1.0Record any web app operation once, AI turns it into a reusable automation tool. Use when: (1) automating repetitive tasks on any web application (reports, su...
⭐ 0· 251·1 current·1 all-time
by@kckyan
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the code: the package records browser actions and network traffic, analyzes requests, generates TS scripts, and manages sessions/credentials for auto-login. However, the registry metadata declares no required binaries or env vars while the code clearly expects Node/ts-node and Playwright and optionally uses RPA_CREDENTIAL_KEY; that mismatch is worth noting.
Instruction Scope
SKILL.md promises redaction and user confirmation for submit tasks, but the code includes an automated extractor (extractAndSaveFromRecording) that searches recordings for POST bodies containing username/password and will save them to the encrypted credential store. That behavior may occur without an explicit, separate confirmation step in some flows. The recorder also captures full network request/response bodies and persists them to disk (recordings and session cookies), which can contain sensitive tokens.
Install Mechanism
There is no install spec in the registry (instruction-only), which is lower risk for remote download, but package.json lists non-trivial dependencies (playwright, ts-node, etc.). The SKILL.md requires Playwright and Node, but the skill metadata doesn't declare these required binaries—an inconsistency the user must handle when installing manually.
Credentials
The skill declares no required environment variables yet the credentials module reads an optional RPA_CREDENTIAL_KEY to strengthen encryption. Credentials are encrypted but the key derivation defaults to machine-identifying values (hostname, username, HOME) when no passphrase is provided, meaning stored credentials are decryptable on the same machine without a user-set passphrase. The skill persists cookies, sessions, and an encrypted credentials file (~/.openclaw/rpa/credentials.enc) — reasonable for auto-login but sensitive and not fully reflected in the declared requirements.
Persistence & Privilege
The skill persists state to ~/.openclaw/rpa/ (recordings, sessions, tasks, credentials.enc). That is expected for an RPA tool, but it raises persistent-privilege concerns: saved cookies/tokens and stored credentials increase the blast radius if the machine or files are compromised. The skill does not request always:true, and it does not modify other skills, which is good.
What to consider before installing
This skill appears to implement the advertised record-and-replay functionality, but you should be cautious before installing/running it on a machine with real accounts:
- It captures network request/response bodies and user actions and saves them under ~/.openclaw/rpa/. Those recordings and saved sessions can contain sensitive cookies, tokens, or form-posted passwords.
- The code includes an extractor that automatically finds username/password pairs in recorded POST bodies and saves them (encrypted) to credentials.enc. That extraction can happen without an obvious separate consent step, so review how you record workflows before using the extractor.
- Credentials.enc is encrypted, but by default the key is derived from machine identity (hostname, username, HOME). If you do not set RPA_CREDENTIAL_KEY, anyone with access to your account/machine can decrypt the file. If you plan to use this skill, set RPA_CREDENTIAL_KEY to a strong passphrase before saving credentials.
- The registry metadata omits required runtime tools (Node, ts-node, Playwright). Do not assume the skill will ‘just work’ without installing those dependencies.
Concrete recommendations:
- Inspect the code locally (especially scripts/utils/credentials.ts and scripts/record.ts) before running.
- If you will store credentials, set RPA_CREDENTIAL_KEY and restrict file permissions (the code already writes 0600 for the encrypted file but confirm). Consider using a dedicated machine or VM for recording sensitive workflows.
- Consider disabling or avoiding use of the extract-and-save CLI helper if you do not want credentials auto-saved; run recordings manually and delete recordings that contain secrets.
- Audit or securely delete ~/.openclaw/rpa/ recordings/sessions/credentials if you stop using the skill.
Given these behaviors (automatic credential extraction/storage and undeclared runtime assumptions), treat the skill as suspicious until you confirm safe configuration and review of the code.Like a lobster shell, security has layers — review code before you run it.
latestvk9794gs0ma4jqjhdch8ekjnr0n82dh1m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.