web-screenshot

🖼️ 任意URL全页面截图 + PDF导出工具。当用户要求截取网页、保存网页快照、截图存档、做QA对比、导出PDF时使用。支持百度/知乎/微信公众号/小红书等中文网站，自动等待JS渲染交付PNG/JPG/PDF。

Security Scan

The skill's code and instructions match its stated purpose (take full-page screenshots and export PDFs via Playwright) and do not request unrelated credentials or exfiltrate data, but it relies on a hardcoded local npx cache path and has no install spec which may cause deployment fragility.

Purpose & Capability

Name/description align with the included script and SKILL.md: both implement screenshot and PDF export using Playwright. Minor oddity: the SKILL.md and script assume a specific npx cache path (/root/.npm/_npx/...), which is not justified by the description and may not exist in target environments.

Instruction Scope

Runtime instructions and the shell script only generate a temporary Playwright JS file, launch a headless Chromium to visit the provided URL, and save a screenshot or PDF. The skill does not read unrelated system files or environment variables, nor does it send captured data to external endpoints.

Install Mechanism

There is no install specification; the SKILL.md claims 'via npx cache, no install needed' and the script sets NODE_PATH to a specific /root npx cache. This is fragile (may fail if Playwright isn't present at that path) but not inherently malicious.

Credentials

The skill requests no environment variables, no credentials, and no config paths. The only environment usage is a local NODE_PATH override inside the script (pointing to a cached npx path), which is internal to execution and not a secret.

Persistence & Privilege

The skill is not always-enabled, can be invoked by users, does not persist configuration or modify other skills, and only writes a temporary JS file and output screenshots/PDFs.

Assessment

This skill appears to be what it claims — a Playwright-based screenshot/PDF tool — but before installing consider: (1) The script hardcodes NODE_PATH to /root/.npm/_npx/...; ensure Playwright is actually available there or modify the script to use npx or an explicit install. (2) There's no install spec — add or run npm/yarn/npx to provide Playwright if your environment lacks it. (3) The script suppresses node stderr (2>/dev/null), which hides errors — remove suppression when debugging. (4) Rendering arbitrary URLs runs untrusted page content inside a headless browser; run the skill in an isolated/sandboxed environment (container) to limit blast radius and potential browser-exploit risk. (5) Login-gated or anti-bot pages may fail as documented. If you need higher assurance, request an install spec (trusted release host) or update the script to fetch Playwright reliably rather than relying on a specific cache path.

When to Use（中文场景）

• 用户要求「截取某个网页」
• 用户要求「保存网页快照」「截图存档」
• 做 QA 对比、报告配图
• 需要把网页导出为 PDF
• 快速查看某个 URL 的视觉效果
• 登录后才可见的页面：不支持，详见 Limitations

适用场景示例

用户："帮我截一下这个知乎回答"
用户："把百度搜索结果截图发给我"
用户："这个公众号文章截图存档"
用户："把这个页面导出PDF"
用户："全页面截图，要看到页面底部"

Tool

Playwright Node.js (via npx cache, no install needed) Path: /root/.npm/_npx/e41f203b7505f1fb/node_modules

Quick Use — Shell Script

bash skills/web-screenshot/scripts/screenshot.sh <url> [output] [--fullpage|--pdf]

Examples:

# Basic screenshot (viewport)
bash scripts/screenshot.sh https://www.baidu.com /tmp/baidu.png

# Full-page screenshot (scrolls to capture entire page)
bash scripts/screenshot.sh https://example.com /tmp/full.png --fullpage

# PDF export
bash scripts/screenshot.sh https://example.com /tmp/page.pdf --pdf

Quick Use — Inline Node.js

NODE_PATH=/root/.npm/_npx/e41f203b7505f1fb/node_modules node -e "
const { chromium } = require('playwright');
(async () => {
  const browser = await chromium.launch({ headless: true, args: ['--no-sandbox'] });
  const page = await browser.newPage({ viewport: { width: 1440, height: 900 } });
  await page.goto('YOUR_URL', { waitUntil: 'domcontentloaded', timeout: 15000 });
  await page.waitForTimeout(2000);
  await page.screenshot({ path: '/tmp/output.png', fullPage: false });
  await browser.close();
})().catch(e => { console.error(e.message); process.exit(1); });
"

Parameters

Parameter	Default	Notes
URL	required	Target URL, must be valid
output path	auto timestamp	/tmp/openclaw/screenshot_YYYYMMDD_HHMMSS.png
--fullpage	viewport only	Captures entire scrollable page
--pdf	screenshot	Exports as A4 PDF

Tips

• For Chinese content: Playwright handles UTF-8 fine, no extra config needed
• For dynamic pages: increase waitForTimeout (e.g. 5000 instead of 2000)
• For PDF: printBackground: true ensures background colors/images are included
• Output size: ~100-150KB for typical pages, ~300KB+ for full-page

Limitations

Login-gated / anti-automation pages: Some sites detect headless browsers and return blank content. Workaround:

• Use the site's API for data instead of screenshots
• Use a real logged-in browser for those pages
• Public static pages work fine

Known sites with issues: GitHub (sometimes), A2H Market (confirmed), sites with Cloudflare protection