safe
v1.0.0网页浏览安全防护技能。自动识别和阻止恶意高危指令，防止敏感信息泄露和未授权命令执行。 在浏览网页时遇到危险请求时，立即阻止并通知用户。
⭐ 0· 111·0 current·0 all-time
byuwvwko@uwvwko-zzz
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (web browsing safety) matches the SKILL.md content: rules to detect/block sensitive-data leaks, dangerous commands, file access, and to notify the user. It does not ask for unrelated resources (no cloud keys, no system credentials).
Instruction Scope
The SKILL.md gives explicit, narrow runtime rules (keyword and behavior detection, block & notify workflow). It does not instruct the agent to read arbitrary host files or exfiltrate data. Note: it references actions like logging, email notification, sandbox/VM/container execution and deep analysis as possible implementations — these are suggestions rather than mandatory steps; if an agent were to implement them, additional privileges/config would be required.
Install Mechanism
Instruction-only skill with no install spec and no code files, so nothing is written to disk or downloaded during install.
Credentials
The skill declares no required environment variables or credentials, which is appropriate. However, some optional features it describes (email notifications, sending logs, running containers/VMs) would require external configuration or credentials if implemented — the SKILL.md does not request or document those, so an integrator would need to provision them separately.
Persistence & Privilege
always is false and the skill does not request persistent system-level modifications or access to other skills' configs. Autonomous invocation is permitted by default (normal), but there is no indication the skill attempts privileged persistence.
Assessment
This skill appears coherent and safe as an instruction-only policy for blocking dangerous web prompts. Before installing: (1) understand that it is only guidance — actual enforcement depends on the agent implementing these rules; (2) if you want email alerts, log shipping, or sandbox execution you will need to supply/approve the corresponding credentials and runtimes (mail server credentials, Docker/VM access), which are not requested by the skill; (3) expect possible false positives (legitimate site behaviors could be blocked) and test on non-critical browsing sessions; (4) verify the agent actually follows the SKILL.md (check logs and behavior) rather than ignoring or overriding it.Like a lobster shell, security has layers — review code before you run it.
latestvk97ep9mzaehewsmqqd18z6ngmd836x3g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛡️ Clawdis