Capture Website
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a straightforward screenshot helper, but users should intentionally install the external npm tool and avoid sending sensitive screenshots through chat services.
This skill is reasonable for taking website screenshots. Before using it, verify and intentionally install the npm CLI it depends on, use user-requested URLs, save screenshots in an appropriate workspace path, and review files before sending them through Discord, Feishu, or any other messaging service.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing a global npm package gives that package code execution on the local machine.
The skill depends on a globally installed third-party npm CLI. This is central to the screenshot purpose, but the artifact set does not provide a pinned install spec or local code for that dependency.
Requires: `npm install -g capture-website-cli`
Install `capture-website-cli` only from a trusted source, prefer a pinned version, and keep it updated.
The tool will visit the requested webpage and create a local screenshot file.
The skill instructs the agent to run a local command with a user-provided URL and write an output file. This is expected for a command-line screenshot skill, but it is still local command execution.
capture-website <URL> --output=/home/aaronz/.openclaw/workspace/screenshot.png
Use it only for URLs you intend to capture, and keep outputs in a workspace or other user-approved folder.
Screenshots may contain private or sensitive webpage content and be shared outside the local environment.
The workflow includes sending the screenshot through a messaging tool, and the description names Discord/Feishu. This is purpose-aligned but can expose captured page contents to an external chat service.
Send via message tool with filePath
Review the screenshot before sending and avoid capturing or forwarding sensitive pages unless the recipient and channel are appropriate.