Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Chatgpt Search
v1.0.0使用浏览器自动化在 ChatGPT 上搜索问题，获取 AI 回答。无需登录即可使用基础功能。
⭐ 0· 100·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (automated ChatGPT queries via browser) matches the included scripts. The scripts call an OpenClaw 'browser' tool to open pages, type queries, snapshot responses and save screenshots. Required binary (node) is reasonable for these JS scripts.
Instruction Scope
SKILL.md and README instruct launching Chromium with --remote-debugging-port=18800 and using a specific user-data-dir. That guidance can expose a browser automation port and, if misused, other browser sessions; the handler and script snapshot page contents and save screenshots which may capture sensitive data. The code itself does not exfiltrate data to external endpoints, but the instructions grant the agent lifecycle control over the browser automation and local screenshot files.
Install Mechanism
No install spec; this is instruction-plus-scripts only (no remote downloads). That keeps disk footprint limited to the skill directory; nothing is fetched from arbitrary URLs during install.
Credentials
The skill requires no environment credentials or config paths. However, it asks (in docs) that users run Chromium with a remote-debugging port which effectively opens a local automation endpoint; this is not a secret but is a capability that can expose browser control. Screenshot saving to /tmp/chatgpt-screenshots may capture sensitive content — consider the directory and permissions.
Persistence & Privilege
Skill is not marked always:true and does not alter other skills or global agent settings by itself. It only writes screenshots/saves under configurable paths and prints instructions for manual configuration; no automatic persistent daemon or self-enabling behavior is present.
What to consider before installing
Before installing: 1) Verify the target domain: the scripts point to https://chatgpt.com rather than chat.openai.com — confirm that this is the intended, trustworthy endpoint (it may be a third‑party site or redirect). 2) Be cautious about running Chromium with --remote-debugging-port: exposing a debugging port can allow remote control of the browser; if you must use it, run Chromium with an isolated user-data-dir and on a machine/network you trust. 3) Screenshots and snapshots are saved locally (default /tmp/chatgpt-screenshots) and may contain sensitive data from your sessions — change the path and review file permissions. 4) Review the scripts yourself (or run them in an isolated VM/container) — the code does not contact external servers other than opening the ChatGPT URL, but it automates browsing and captures page content. 5) If you need greater assurance, ask the author to explain why chatgpt.com is used, whether redirects occur to an official domain, and whether the skill can be run without enabling a globally exposed debugging port. Installing is reasonable if you accept these risks and run it in an isolated environment; otherwise treat it as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk979b7p7pcjp690224sabxfak58389yr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🤖 Clawdis
Binsnode