Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- hooks/url-auto-fetch/handler.ts:84
Security audit
Amber_Url_to_Markdown
Security checks for vulnerabilities and agentic risk
Overview
The skill's stated purpose (convert URLs to Markdown) matches the code, but the Hook-based auto-trigger, instructions to persist cookies / inject authentication into scripts, and lack of declared config/path requirements create privacy and operational risks that users should understand before enabling.
This skill appears to do what it says (convert URLs to Markdown) but has several operational and privacy risks you should weigh before installing or enabling the Hook: - Do not enable the url-auto-fetch Hook system-wide unless you trust all users who can send messages. The Hook will run on message:received and can fetch any URL a user sends (including internal/localhost endpoints). - Inspect the Hook handler (hooks/url-auto-fetch/handler.ts) before enabling to confirm how it constructs shell calls; ensure URLs are safely sanitized/escaped to avoid shell injection. - The docs recommend persisting browser context and even pasting full Cookie strings into scripts for some sites. Never paste sensitive credentials into code in shared environments; prefer ephemeral credentials or avoid authenticating the skill. - The skill writes outputs and user data under /root/openclaw/... and may create doubao_user_data containing cookies. Confirm those paths are acceptable and run the skill as a non-root, isolated user where possible. - If you must test it, run it in an isolated environment (VM/container) with network controls to prevent SSRF or access to internal services. Limit allowed domains (white-list) if your OpenClaw/Gateway supports it. - Only install required Python packages from known sources and run `playwright install` in a controlled environment. If you want to proceed: (1) review handler.ts to confirm safe invocation, (2) do not paste credentials into repository files, (3) enable the Hook only for trusted users or with a domain whitelist, and (4) run the skill in a sandboxed account/environment.
Static analysis
Detected: suspicious.dangerous_exec