Browser

Uses a headless browser to navigate web pages, interact with elements, and extract clean, readable text content from URLs.

Security Scan

The skill's code and instructions match its stated purpose (use Puppeteer to render pages and return text); there are no unexplained credentials, external endpoints, or install tricks, but there are operational and privacy considerations (arbitrary URL access, Chromium download via Puppeteer, and use of --no-sandbox).

Purpose & Capability

Name/description say headless browser for rendering and extracting page text; index.js uses Puppeteer to launch a browser, navigate to the provided URL, and return document.body.innerText. The required artifacts (no env vars, no config paths) match this simple browser scraper purpose.

Instruction Scope

SKILL.md and the CLI accept arbitrary URLs and instruct the agent to render and extract page content. This is expected for a browser skill, but it means the agent (or user) can direct the skill to fetch internal endpoints (metadata services, internal webapps) or pages that execute arbitrary JavaScript. The instructions do not attempt to restrict which URLs may be requested.

Install Mechanism

There is no install spec in the skill bundle (instruction-only), but README lists 'puppeteer' as a dependency and index.js requires it. Installing Puppeteer (npm) typically downloads Chromium from upstream servers. That behavior is expected but worth noting because it causes a network download of a large binary when dependencies are installed. No suspicious download URLs or custom installers are present in the bundle.

Credentials

The skill requests no environment variables, credentials, or config paths. That aligns with its purpose. There are no hidden env accesses in the code. However, because it renders pages and executes page JS, extracted content may include secrets present on visited pages.

Persistence & Privilege

Flags show always:false and normal, model-invocation allowed — appropriate for a user-invocable browsing helper. The skill does not modify other skills or system-wide settings.

Assessment

This skill is internally consistent and appears to do what it says: launch Puppeteer, visit a URL, and return the page's text. Before installing or using it, consider: (1) Puppeteer will need to be installed (npm install puppeteer) and that typically downloads a Chromium binary from upstream servers — install that dependency from a trusted environment. (2) The skill will render any URL you give it, including internal IPs or metadata endpoints; avoid passing sensitive internal URLs unless you trust the execution environment. (3) The code launches Chromium with --no-sandbox, which is common in containerized CI environments but increases risk if run in an untrusted host — run the skill in isolation/secure sandboxing if possible. (4) If you need agent-autonomous browsing disabled, restrict model invocation or limit the skill's use. If you want additional scrutiny, provide package.json or an explicit install script so you can verify exactly how Puppeteer/Chromium will be installed.

SKILL: Browser

This skill uses a headless browser (Puppeteer) to render web pages and extract clean, readable content.

Puppeteer Browser Automation

This is a custom skill generated by OpenClaw to handle headless web browsing. It utilizes the Puppeteer library to navigate to websites, interact with DOM elements, click buttons, and scrape data for the agent's context.

Usage

openclaw browser read <url> - Renders the page and returns its text content.