Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent guide for attaching OpenClaw to a user-selected Chrome tab, but users should treat the browser session and gateway token as sensitive.
Install only if you intend to let OpenClaw control a Chrome tab you choose. Avoid attaching banking, admin, email, or other highly sensitive sessions unless you are comfortable with the agent viewing and acting on that page, and do not paste the gateway token into chats, logs, screenshots, or shared terminals.
This skill enables an agent to attach to and control an already-authenticated Chrome tab, which can change page state, submit forms, and act with the user's existing session. The documentation presents this capability as operationally convenient but does not warn users that using it may expose accounts, modify data, or trigger irreversible actions in live services.
The instructions tell users to print the gateway authentication token from a local config file and manually enter it into the extension, but provide no guidance on treating that token as a secret. Exposing or mishandling the token could allow unauthorized local control of the browser gateway, especially since the gateway can drive attached tabs and access sensitive authenticated browser context.
The natural-language instructions throughout the file are presented in Chinese, while some UI labels remain in English, and there is no indication that the user can choose another language. This can violate a language/locale policy when a specific language is imposed without opt-in or documented justification.
No suspicious patterns detected.
