Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent Browser 0.2.0 (1)
v1.0.0A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co...
⭐ 0· 16·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description describe a CLI headless-browser wrapper and the skill only requires node and npm (matching npm-based installation). Commands in SKILL.md correspond to typical browser automation features; no unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md gives concrete CLI commands for installing and using agent-browser and limits runtime actions to browser navigation, interactions, snapshots, recordings, cookies/storage, and file uploads. It does not instruct the agent to read unrelated system files or environment variables. Note: operations like upload, screenshot, and recording imply access to local files and stdout/stderr, which is expected for a browser automation tool.
Install Mechanism
There is no formal install spec in the registry bundle (instruction-only). SKILL.md recommends 'npm install -g agent-browser' or building from a GitHub repo. Installing from npm or running 'agent-browser install' will fetch and execute code from external sources; this is expected but carries the usual npm/package trust risk (moderate).
Credentials
The skill requests no environment variables, credentials, or config paths beyond node/npm availability. That is proportionate to a CLI wrapper that uses npm for installation and runs local browser automation commands.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not attempt to modify other skills' configs or require system-wide changes beyond running the CLI it documents.
Assessment
This skill appears to be a straightforward wrapper for the agent-browser CLI and is internally consistent. Before installing or allowing the agent to run it: (1) verify the npm package and upstream GitHub repository and maintainer reputation (npm packages run code on install), (2) avoid running it with access to sensitive files you don’t want uploaded or recorded (the tool supports file upload, screenshots, and recording), (3) prefer installing and inspecting the package manually in a sandbox or VM if you’re unsure, and (4) if you need higher assurance, check the package contents and agent-browser source code for unexpected network endpoints or code that exfiltrates data.Like a lobster shell, security has layers — review code before you run it.
latestvk973e5gznzqc9r8tq1baxd556d84h430
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌐 Clawdis
Binsnode, npm