Enable or disable the OpenClaw built-in browser with one command, featuring auto backup, recovery, and cross-platform support.

This skill appears to do what it says: it modifies ~/.openclaw/openclaw.json to enable/disable the built-in browser and keeps backups. Before installing: (1) verify the skill source — files reference GitHub but the registry source/homepage are 'unknown' — prefer an authoritative repository; (2) inspect browser_toggle.py (it is short and readable) and the backup directory to confirm no unexpected behavior; (3) do not allow creation of a global symlink (/usr/local/bin) unless you trust the package (the installer only attempts this if it has permission); (4) if you are unsure, run the code in an isolated environment/VM or manually copy the single script into your OpenClaw skills folder and run it without running setup.sh. The skill does modify your OpenClaw configuration and requires restarting OpenClaw to take effect — back up important data before proceeding.

Type: OpenClaw Skill Name: browser-toggle Version: 1.0.1 The skill is classified as suspicious due to a local file overwrite vulnerability found in `browser_toggle.py`. The `restore_from_backup` function and its corresponding `--restore` CLI argument allow an arbitrary file path to be specified as the source for restoration. This means an attacker could potentially overwrite the `~/.openclaw/openclaw.json` configuration file with the content of any file on the system that the script's user has read access to, leading to denial of service or information disclosure if the overwritten content is later displayed. While the skill's stated purpose is benign, this lack of input sanitization presents a significant vulnerability, even though there is no evidence of intentional malicious behavior like data exfiltration or persistence.