Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Chrome Remote Browser Guide
v1.0.0Guide for AI agents on how to use Chrome Remote Debugging (CDP on port 9222) to automate browser interactions. Covers the full lifecycle — connecting, naviga...
⭐ 0· 43·0 current·0 all-time
byGuangxianLiu@lgx-00
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description promise a CDP-based browser automation guide; SKILL.md exclusively documents connecting to Chrome Remote Debugging (port 9222), opening tabs, snapshots, interactions, and executing JS. There are no unrelated env vars, binaries, or installs requested — capability requirements align with the stated purpose.
Instruction Scope
Instructions explicitly permit taking screenshots, reading the accessibility/DOM tree, and executing arbitrary JavaScript in page context — all expected for browser automation. The guide advises capturing screenshots and snapshots before/after actions. One ambiguity: SKILL.md claims screenshots 'Return: A CDN URL' without describing how upload/hosting is performed or whether data leaves the host; that could imply external upload behavior which is not defined here and should be clarified.
Install Mechanism
No install spec and no code files (instruction-only). This minimizes disk-installed attack surface — the guide only describes runtime actions against a locally running Chrome instance.
Credentials
The skill requests no environment variables, which is proportionate. However, attaching to Chrome's remote debugging port inherently grants access to the user's browser context (DOM, cookies, storage, arbitrary JS execution and therefore anything the user is logged into). That sensitivity is intrinsic to the feature and not signaled by credentials in the manifest; users should treat this as high-privilege access to local accounts/sessions.
Persistence & Privilege
always:false and normal autonomous invocation settings. The skill does not request persistent installation or modifications to other skills/config; it does not request elevated platform privileges in the manifest.
Assessment
This guide is internally consistent for controlling Chrome via the remote debugging port, but it grants the agent direct access to everything in your browser (logged-in accounts, cookies, local storage, page content) and lets it run arbitrary JavaScript. Only enable Chrome with --remote-debugging-port=9222 for agents you fully trust, and disable it when not in use. Prefer using a dedicated or ephemeral browser profile, or an isolated VM/container, when automating authenticated flows. Ask the skill author or platform how screenshots are stored/shared (the SKILL.md mentions a 'CDN URL' but gives no uploader details). Finally, ensure port 9222 is not exposed to untrusted networks (bind to localhost or use firewall rules).Like a lobster shell, security has layers — review code before you run it.
latestvk976nv8dvzq2deez03e0abgrg583p2hf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.