Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Claw Browser
v1.0.2A visual, human-like web browser for OpenClaw agents.Supports reading,screenshots, and visible mode.
⭐ 0· 812·3 current·5 all-time
byCan Birlik@canbirlik
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (visual browser) match the included code and SKILL.md. The skill uses Playwright to render pages, handle JS, take screenshots, and support visible/headless modes — exactly what a browser skill needs.
Instruction Scope
Instructions are specific: create a venv, pip install requirements, run 'playwright install chromium', then execute browser.py with --url and --action. The script navigates to the provided URL, extracts document.body.innerText (first ~5000 chars) and title, and optionally saves a screenshot. There is no attempt to read other system files or environment secrets. Caveat: the skill accepts arbitrary URLs (including internal network and file:// URLs) and will return page text/screenshots — this is expected for a browser but is a potential data-exposure vector if the agent is allowed to fetch internal or sensitive endpoints.
Install Mechanism
There is no packaged install spec; installation is done by running the provided shell steps which use pip and 'playwright install chromium'. These are standard, well-known mechanisms; the Playwright step will download browser binaries from Playwright's upstream — expected for browser automation.
Credentials
The skill does not request any secrets or external credentials. It suggests setting DISPLAY for visible mode (a non-secret OS variable). No environment variables or config paths are required, which is proportionate to its purpose.
Persistence & Privilege
always is false and the skill is user-invocable; model invocation is enabled (platform default). The skill does not request persistent system-wide privileges or modify other skills/configs.
Assessment
This skill is coherent and implements a standard Playwright-based browser. Before installing, consider: 1) Playwright will download Chromium binaries from the network — ensure your environment/network policy permits that. 2) The skill will access any URL it's given (including internal IPs, metadata endpoints, or file:// paths) and will print page text and save a screenshot (evidence.png) to the working directory — avoid letting it visit sensitive internal services or files. 3) If you are concerned about autonomous browsing, restrict invocation to user-only or run the skill in a sandboxed/container environment with limited network access. 4) Review and run the included browser.py yourself if you want to validate behavior; it is small and straightforward. If you want extra safety, add URL whitelisting or input validation before allowing agent-driven calls.Like a lobster shell, security has layers — review code before you run it.
latestvk973cmmt076mxw8n0fkwa3re6181d3mp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.