Back to skill
Skillv1.0.0
ClawScan security
Web to Excel · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 15, 2026, 4:09 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions match its stated purpose (scrape structured data from web pages and write it to Excel); requested actions and resources are proportionate, with a few operational notes about runtime pip installs and reliance on a local browser CDP client.
- Guidance
- This skill appears to do what it says: scrape tabular/parameter text from a webpage and fill user-specified Excel cells. Before using it: (1) test with a non-sensitive Excel file and a non-sensitive target URL; (2) confirm you are OK with the script installing two PyPI packages at runtime (websockets, openpyxl) or install them yourself beforehand; (3) review the cdp_client module located at ~/Library/Application Support/QClaw/openclaw/config/skills/browser-cdp/scripts if possible — the skill imports and reuses that local client and connects to 127.0.0.1:9334 (ensure that CDP service is the expected browser debug endpoint); (4) avoid giving it access to sensitive spreadsheets unless you trust the environment. If you want extra caution, run the script in an isolated environment (VM/container) or preinstall and pin dependencies and inspect the cdp_client implementation first.
Review Dimensions
- Purpose & Capability
- okName/description (web → Excel) align with the code and instructions: the script extracts text from a page, parses tab-separated parameter blocks, maps fields and writes into an Excel file. The required packages (websockets, openpyxl) and the use of a CDP connection to a browser are coherent with scraping and writing Excel.
- Instruction Scope
- noteThe SKILL.md and script only read the target webpage (via a local CDP connection) and the user-specified Excel file, then write back to that Excel file. However, the runtime imports a CDP client from a path under the agent config ('~/Library/Application Support/QClaw/openclaw/config/skills/browser-cdp/scripts') and connects to a local CDP endpoint (http://127.0.0.1:9334). This cross-skill path dependency is plausible for reusing the platform's browser client but means the skill will rely on whatever cdp_client exists at that path; review that module if you have concerns.
- Install Mechanism
- noteThere is no package-install spec in the registry, but both SKILL.md and web_scraper.py perform runtime pip installs (websockets, openpyxl) using subprocess.check_call. Installing these PyPI packages is reasonable for the task, but runtime pip installs fetch code from the network — verify you trust the environment's PyPI source and prefer pinned versions or preinstalled dependencies in more security-sensitive contexts.
- Credentials
- okThe skill requests no environment variables or external credentials. It requires user-supplied inputs (Excel file path, sheet name, row range, URL) and accesses local resources (the provided Excel file, and a local browser CDP endpoint). Those are proportional to its stated goal, but note it will read/modify the specified Excel file and connect to the local browser debugging endpoint.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request elevated or persistent platform privileges. It does not modify other skills' configurations. Its only nonstandard action is importing a module from the agent config path at runtime (no config writes observed).