Code PluginExecutes codesource-linked

WebStack

OpenClaw Bright Data plugin

Community code plugin. Review compatibility and verification before install.

@brightdata/brightdata-plugin · runtime id brightdata

Install

openclaw plugins install clawhub:@brightdata/brightdata-plugin

Latest Release

Version 1.0.3

Download zip

Compatibility

{
  "builtWithOpenClawVersion": "2026.3.28",
  "minGatewayVersion": "2026.3.24",
  "pluginApiRange": ">=2026.3.24",
  "pluginSdkVersion": "2026.3.28"
}

Capabilities

{
  "bundledSkills": [],
  "capabilityTags": [
    "executes-code"
  ],
  "channels": [],
  "commandNames": [],
  "configSchema": true,
  "configUiHints": false,
  "executesCode": true,
  "hooks": [],
  "httpRouteCount": 0,
  "materializesDependencies": false,
  "providers": [],
  "runtimeId": "brightdata",
  "serviceNames": [],
  "setupEntry": false,
  "toolNames": []
}

Security Scan

VirusTotal

Pending

View report →

OpenClaw

Suspicious

medium confidence

ℹ

Purpose & Capability

Name/description (Bright Data web search, scraping, browser automation) align with the code and dependencies (playwright, many scraping/search tools). However the registry metadata claims 'Required env vars: none' while the SKILL.md and openclaw.plugin.json clearly expect a Bright Data API token (BRIGHTDATA_API_TOKEN or plugin config) and optionally zone env vars, which is an inconsistency.

Instruction Scope

SKILL.md asks the user to provide an API token (env var or config) and optionally zone names; it also declares that the plugin will automatically create proxy zones on first use (i.e., perform account-side changes). The SKILL.md (README) contains a detected prompt-injection pattern ('ignore-previous-instructions'). The instructions reference environment variables not declared in registry metadata (BRIGHTDATA_API_TOKEN, BRIGHTDATA_UNLOCKER_ZONE, BRIGHTDATA_BROWSER_ZONE). Those discrepancies widen the runtime surface the agent may access and should be explicit in metadata.

ℹ

Install Mechanism

No install spec is declared in the registry entry (marked instruction-only), but the package includes full source, package.json and a package-lock.json with dependencies (notably playwright). Playwright is expected for browser automation and will pull browser binaries on install, which is heavy but coherent. The presence of a large lockfile (with many transitive packages) increases the audit surface — not inherently malicious, but worth review.

Credentials

The plugin requires a Bright Data API token (sensitive) and optionally zone environment variables, but the registry metadata did not list required env vars or a primary credential. openclaw.plugin.json does define config keys and marks the API token as sensitive, but the public metadata omission is an incoherence. The number and sensitivity of env values (API token, zone names) are proportionate to the plugin's purpose — but they should have been declared in the manifest.

ℹ

Persistence & Privilege

The plugin is not flagged always:true and follows normal autonomous-invocation defaults. It may create Bright Data proxy zones automatically (remote account changes), which is a legitimate but impactful action — the user should be aware that the plugin will modify resources in their Bright Data account on first use.

Scan Findings in Context

[ignore-previous-instructions] unexpected: A prompt-injection pattern was detected in SKILL.md/README. This pattern makes little sense for a Bright Data plugin README and should be investigated; it may be an accidental inclusion (false positive) but merits attention.

What to consider before installing

This plugin appears to implement Bright Data search/scrape/browser tools and includes source and dependencies (including Playwright). Before installing: 1) Confirm you trust the Bright Data publisher and are comfortable supplying a Bright Data API token — the plugin will use that token and may auto-create proxy zones in your Bright Data account. 2) Ask the publisher to correct the registry metadata to declare required environment variables (BRIGHTDATA_API_TOKEN and optional zone env vars) so the surface is explicit. 3) Inspect package-lock.json for unexpected dependencies if you require a minimal dependency set. 4) Because the plugin enables browser automation (Playwright), install and run it in an isolated environment if you want to audit behavior first. 5) Investigate the detected 'ignore-previous-instructions' pattern in the README — it's unusual and should be removed or explained. If you’re not comfortable with these inconsistencies, request corrections from the publisher or test in a sandbox before granting tokens or production access.

✗

src/brightdata-browser-tools.ts:101

Dynamic code execution detected.

Patterns worth reviewing

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Verification

{
  "hasProvenance": false,
  "scanStatus": "pending",
  "scope": "artifact-only",
  "sourceCommit": "7914d9e",
  "sourceRepo": "brightdata/openclaw-plugin",
  "sourceTag": "main",
  "summary": "Validated package structure and linked the release to source metadata.",
  "tier": "source-linked"
}

What This Plugin Does

This plugin brings the full power of Bright Data's infrastructure directly into your OpenClaw agent — no manual API wiring, no proxies to configure. Install once, and your agent gains:

Real-time web search via Google, Bing, and Yandex with geo-targeting
Bot-bypass scraping through Bright Data Web Unlocker — handles CAPTCHAs, JS rendering, and rate limits automatically
Full browser automation via a real Chromium instance routed through Bright Data's residential proxy network
50+ structured data tools for Amazon, LinkedIn, Instagram, TikTok, YouTube, Reddit, and more — no parsing required

Install

openclaw plugins install @brightdata/brightdata-plugin

Configure

Get your API token at brightdata.com → Account → API Token.

# Option A — environment variable (recommended for local dev)
export BRIGHTDATA_API_TOKEN=your_token_here

# Option B — OpenClaw config (recommended for persistent setups)
openclaw config set plugins.entries.brightdata.config.webSearch.apiKey your_token_here

The plugin automatically creates two proxy zones on first use: mcp_unlocker (Web Unlocker) and mcp_browser (Browser API). No manual zone setup required.

To use existing zones instead:

export BRIGHTDATA_UNLOCKER_ZONE=my_existing_zone
export BRIGHTDATA_BROWSER_ZONE=my_existing_browser_zone

Tools Overview

66 tools across five categories:

Category	Count	What it does
Search	2	Real-time SERP results from Google, Bing, Yandex
Scrape	1	Full-page extraction with bot bypass
Batch	2	Parallel search and scrape up to 5 at a time
Browser	14	Full browser control via residential proxies
Web Data	47	Structured data from 47 platforms

Search

The plugin registers automatically as an OpenClaw web search provider — it appears alongside other providers in the search provider selection UI.

`brightdata_search`

Search Google, Bing, or Yandex and get structured results back.

Parameter	Type	Description
`query`	`string`	Required. Search query
`engine`	`"google" \| "bing" \| "yandex"`	Search engine (default: `google`)
`count`	`number`	Results to return, 1–10
`cursor`	`string`	Pagination cursor for next page
`geo_location`	`string`	2-letter ISO country code (e.g. `"us"`, `"de"`)
`timeoutSeconds`	`number`	Request timeout override

`brightdata_search_batch`

Run up to 5 search queries in parallel. Partial failures are returned inline without failing the whole batch.

Scrape

`brightdata_scrape`

Fetch any page through Bright Data Web Unlocker. Works on bot-protected sites, JavaScript-rendered pages, and geo-restricted content.

Parameter	Type	Description
`url`	`string`	Required. HTTP/HTTPS URL to scrape
`extractMode`	`"markdown" \| "text" \| "html"`	Output format (default: `markdown`)
`maxChars`	`number`	Maximum characters to return (min: 100)
`timeoutSeconds`	`number`	Request timeout override

`brightdata_scrape_batch`

Scrape up to 5 URLs in parallel with the same extraction options.

Browser Automation

Full Chromium browser control routed through Bright Data's residential proxy network. Sessions are automatically scoped per user context and idle-timeout after 10 minutes.

Tool	Description
`brightdata_browser_navigate`	Navigate to a URL (optional country routing)
`brightdata_browser_snapshot`	Capture an ARIA snapshot with interactive element refs
`brightdata_browser_click`	Click an element by its snapshot ref
`brightdata_browser_type`	Type into a field by ref (optional Enter to submit)
`brightdata_browser_fill_form`	Fill multiple form fields in a single operation
`brightdata_browser_screenshot`	Take a screenshot (viewport or full page)
`brightdata_browser_get_html`	Get current page HTML
`brightdata_browser_get_text`	Get current page text content
`brightdata_browser_scroll`	Scroll to bottom of page
`brightdata_browser_scroll_to`	Scroll to a specific element by ref
`brightdata_browser_wait_for`	Wait for an element to become visible
`brightdata_browser_network_requests`	List network requests since page load
`brightdata_browser_go_back`	Navigate back
`brightdata_browser_go_forward`	Navigate forward

Web Data — 50+ Platforms

Structured data from real pages via Bright Data datasets. Each tool accepts a url or keyword and returns clean, typed JSON — no scraping, no parsing.

<details> <summary>E-commerce (10 tools)</summary>

Tool	Data
`brightdata_amazon_product`	Product details, pricing, specs
`brightdata_amazon_product_reviews`	Customer reviews and ratings
`brightdata_amazon_product_search`	Search results with rankings
`brightdata_walmart_product`	Product details and availability
`brightdata_walmart_seller`	Seller profile and metrics
`brightdata_ebay_product`	Listing details and bids
`brightdata_homedepot_products`	Product catalog and pricing
`brightdata_zara_products`	Fashion catalog data
`brightdata_etsy_products`	Handmade and vintage listings
`brightdata_bestbuy_products`	Electronics catalog and deals

</details> <details> <summary>Professional Networks (7 tools)</summary>

Tool	Data
`brightdata_linkedin_person_profile`	Full person profile
`brightdata_linkedin_company_profile`	Company overview and stats
`brightdata_linkedin_job_listings`	Open positions with details
`brightdata_linkedin_posts`	Post content and engagement
`brightdata_linkedin_people_search`	People search results
`brightdata_crunchbase_company`	Funding, investors, founders
`brightdata_zoominfo_company_profile`	Company intelligence data

</details> <details> <summary>Social Media (17 tools)</summary>

Instagram

Tool	Data
`brightdata_instagram_profiles`	Profile stats and bio
`brightdata_instagram_posts`	Post content and engagement
`brightdata_instagram_reels`	Reel metadata and views
`brightdata_instagram_comments`	Comment threads

Facebook

Tool	Data
`brightdata_facebook_posts`	Post content and reactions
`brightdata_facebook_marketplace_listings`	Marketplace items
`brightdata_facebook_company_reviews`	Page reviews and ratings
`brightdata_facebook_events`	Event details and attendance

TikTok

Tool	Data
`brightdata_tiktok_profiles`	Creator profile and stats
`brightdata_tiktok_posts`	Video content and metrics
`brightdata_tiktok_shop`	TikTok Shop product data
`brightdata_tiktok_comments`	Comment threads

X (Twitter)

Tool	Data
`brightdata_x_posts`	Post content and metrics
`brightdata_x_profile_posts`	Profile post history

YouTube & Reddit

Tool	Data
`brightdata_youtube_profiles`	Channel stats and info
`brightdata_youtube_videos`	Video details and metrics
`brightdata_youtube_comments`	Comment threads
`brightdata_reddit_posts`	Post content and scores

</details> <details> <summary>Maps, Shopping & Apps (4 tools)</summary>

Tool	Data
`brightdata_google_maps_reviews`	Location reviews and ratings
`brightdata_google_shopping`	Shopping results and prices
`brightdata_google_play_store`	App details and reviews
`brightdata_apple_app_store`	App details and reviews

</details> <details> <summary>Finance, News & Code (3 tools)</summary>

Tool	Data
`brightdata_reuter_news`	Reuters news articles
`brightdata_yahoo_finance_business`	Company financials and news
`brightdata_github_repository_file`	Repository file contents

</details> <details> <summary>Real Estate & Travel (2 tools)</summary>

Tool	Data
`brightdata_zillow_properties_listing`	Property listings and estimates
`brightdata_booking_hotel_listings`	Hotel listings and pricing

</details> <details> <summary>AI Insights (3 tools)</summary>

Tool	Data
`brightdata_chatgpt_ai_insights`	ChatGPT responses
`brightdata_grok_ai_insights`	Grok responses
`brightdata_perplexity_ai_insights`	Perplexity responses

</details>

Configuration Reference

All settings can be provided via environment variable or OpenClaw config. Environment variables take priority.

Setting	Environment Variable	Config Path	Default
API Token	`BRIGHTDATA_API_TOKEN`	`...webSearch.apiKey`	required
Base URL	`BRIGHTDATA_BASE_URL`	`...webSearch.baseUrl`	`https://api.brightdata.com`
Unlocker Zone	`BRIGHTDATA_UNLOCKER_ZONE`	`...webSearch.unlockerZone`	`mcp_unlocker`
Browser Zone	`BRIGHTDATA_BROWSER_ZONE`	`...webSearch.browserZone`	`mcp_browser`
Request Timeout	—	`...webSearch.timeoutSeconds`	`30s` search / `60s` scrape
Polling Timeout	—	`...webSearch.pollingTimeoutSeconds`	`600s`

Config paths are prefixed with plugins.entries.brightdata.config.

Plugin Management

# Install
openclaw plugins install @brightdata/brightdata-plugin

# Verify installation and loaded tools
openclaw plugins inspect brightdata

# Update to latest version
openclaw plugins update brightdata

# Temporarily disable
openclaw plugins disable brightdata

# Re-enable
openclaw plugins enable brightdata

# Uninstall
openclaw plugins uninstall brightdata

Requirements

OpenClaw installed and running
A Bright Data account with API token
Node.js 22+ (managed by OpenClaw)

WebStack

What This Plugin Does

Install

Configure

Tools Overview

Search

brightdata_search

brightdata_search_batch

Scrape

brightdata_scrape

brightdata_scrape_batch

Browser Automation

Web Data — 50+ Platforms

Configuration Reference

Plugin Management

Requirements

License

`brightdata_search`

`brightdata_search_batch`

`brightdata_scrape`

`brightdata_scrape_batch`