Clawbrowser Skill
Security checks across malware telemetry and agentic risk
Overview
The skill's code and requirements match its stated purpose (headless browser automation); it performs local caching and file output and has an optional Feishu upload path that you should review before use.
This skill appears to do what it says (browser automation + scraping) but take these precautions before installing: - Verify the provenance of the agent-browser package before running `npm install -g agent-browser` (typosquatting or malicious npm packages are common). - Expect a large download when running `agent-browser install` (it downloads a browser binary). Run in a sandbox/container if you want to avoid affecting your host. - The skill will write cache files to ~/.openclaw/cache and save scraped JSON/MD files to ./scraped_content (or whatever output dir you set). Make sure you’re okay with those files and paths. - The web_scraper module has an optional branch that imports a feishu_doc module and will attempt to upload scraped content to Feishu if that module/credentials exist — review that flow and any Feishu credentials before enabling or running save_to_feishu=True. - If you plan to run batch scraping, be aware it may fetch many pages and generate local files; ensure you have permission to scrape the target sites and avoid scraping sensitive internal URLs. If you’re uncertain, run the tool in an isolated environment (container or VM), inspect the agent-browser package and any third-party modules (feishu_doc), and review the code yourself before granting it network or filesystem access.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings