xvfb-chrome

在Linux服务器上使用Chrome浏览器(无头/有头模式)配合xvfb运行，可连接chrome-devtools MCP进行浏览器自动化

This is a coherent how-to for running Chrome under Xvfb, but review before running: 1) The SKILL.md expects google-chrome (or chromium), Xvfb/xvfb-run, and a third-party MCP client 'mcporter'—the skill metadata doesn't list these required binaries; ensure you have trusted versions installed. 2) The guide recommends --no-sandbox and enabling --remote-debugging-port; both reduce browser isolation and can expose a debugging interface if not bound to localhost—do not expose the port to untrusted networks and avoid running as root. 3) Paths like /root/screenshot.png indicate actions that may require elevated permissions; prefer non-root paths. 4) 'mcporter' is not a standard system tool—verify its origin and trustworthiness before invoking it. 5) Because the skill is instruction-only, it won't install code automatically, but the shell commands it suggests perform powerful operations (process killing, starting services, file writes); run them in a controlled environment (container or non-production server) and inspect commands first.

Type: OpenClaw Skill Name: xvfb-chrome Version: 1.0.2 The skill bundle is classified as suspicious due to the use of the `--no-sandbox` flag for `google-chrome` in `SKILL.md`. While often necessary for browser automation in server environments, this flag significantly reduces the browser's security posture, making it more vulnerable to exploitation. Additionally, an example command suggests saving a screenshot to `/root/screenshot.png`, which could lead to permission issues or unintended file writes depending on the agent's execution context. These are considered vulnerabilities rather than explicit malicious intent, as the overall purpose of the skill (browser automation with XVFB) is legitimate.