Nova Act Browser Automation

• Risk level: Low
• Analyzed: Feb 16, 2026, 5:40 AM
• Findings: 0
• Version: 1.6.0

Overview

This skill appears to do what it says—browser automation via Amazon Nova Act using the uv runner and an NOVA_ACT_API_KEY—with only minor documentation and install-spec inconsistencies to review before use.

This skill is coherent for running Amazon Nova Act browser automation and includes sensible safety guardrails, but review these before installing: 1) Confirm NOVA_ACT_API_KEY is scoped appropriately and keep the key secret. 2) Do not pass your entire environment to the child process—pass only NOVA_ACT_API_KEY to avoid exposing unrelated secrets. 3) Ensure the Python dependencies (nova-act, pydantic, fire) are installed in the runtime environment; the skill's install spec only installs 'uv' via brew. 4) Be aware the skill writes trace files (screenshots, HTML) to the working directory; review/delete them if they contain PII. 5) Note the small doc mismatch: SKILL.md mentions reading ~/.openclaw/openclaw.json for the API key but the included runner only reads the NOVA_ACT_API_KEY env var. If you need higher assurance, verify the 'nova-act' package is the official Amazon client and inspect it for any unexpected network endpoints or behavior.