Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Clone Anywebsite
v1.0.1High-fidelity visual-first web rebuilding from design references. Screenshot-driven analysis, DOM interrogation for exact CSS values, asset inspection (WebGL...
⭐ 0· 81·0 current·0 all-time
bySolomon Neas@solomonneas
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description claim visual-first web cloning; the SKILL.md exclusively describes DOM interrogation, screenshots, targeted JS snippets, and asset extraction — all directly aligned with that purpose. There are no unrelated env vars, binaries, or install steps requested.
Instruction Scope
Instructions explicitly tell the agent to take screenshots, run targeted JS in the page context, capture computed styles, and 'rip' complex assets (WebGL canvases → .webm, fonts, images). This is expected for a cloning tool, but it means the agent will perform broad data collection from arbitrary web pages and download assets — which raises legal/ethical and potential data-exfiltration concerns if used on sites without permission. The SKILL.md also references agent tooling identifiers (mcp_chrome-devtools_*), so proper runtime tool permissions are required.
Install Mechanism
Instruction-only skill with no install spec and no code files. Low technical risk from installation because nothing is downloaded or written by the skill itself.
Credentials
The skill requests no environment variables, credentials, or config paths. The absence of requested secrets is proportionate to its stated function (no cloud or third-party API keys are required by the instructions).
Persistence & Privilege
always is false and the skill is user-invocable. It does not request permanent presence or system-wide config changes. Autonomous model invocation is permitted by platform default but not unusual here.
Assessment
This skill appears coherent for building clones of sites you own or have permission to copy, but it explicitly instructs the agent to scrape pages and download assets (including ripped WebGL canvases, fonts, images). Before installing or using it: 1) only run it against sites you control or have explicit permission for — copying third-party design or assets may violate copyright and terms of service; 2) verify your agent’s runtime has the browser/DevTools capabilities the skill expects (mcp_chrome-devtools_* actions) and restrict those tools if you don’t want broad page access; 3) consider preventing autonomous use or requiring explicit user confirmation before the skill visits external URLs or writes files to disk; and 4) if you need stronger assurance, request the full SKILL.md to be reviewed for any later sections that might instruct uploading collected assets to external endpoints or reading local files (those would change the assessment).Like a lobster shell, security has layers — review code before you run it.
latestvk97d51kqa2d8d5y143can2kjcs83a24w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
