通过Chrome扩展记录目标系统业务流程的完整API调用，生成详细接口文档和实现方案辅助AI重构。

This skill appears to do exactly what it says: inject a monitoring script into Chrome to capture fetch/XHR and produce API logs and documentation. Before installing or running it, consider the following: 1) Legal/ethical: only run against systems you own or where you have explicit permission—the README even suggests 'explore security boundaries', which could be intrusive. 2) Sensitive data: the script records request/response bodies and headers (including Authorization tokens, cookies, form data, PII). Treat generated logs as highly sensitive, avoid sharing them, and redact tokens/passwords before storing or sending them elsewhere. 3) Trust: the source/homepage is not authoritative; you can inspect the included network-monitor.js (it is readable and does not perform external network exfiltration), but if you plan to use it in production, verify the code and consider adding automatic redaction of Authorization/cookie headers. 4) Operational: the workflow requires enabling a browser extension and OpenClaw gateway/token—ensure those tokens are managed securely. If any of the above is a concern, do not run this skill until you obtain explicit authorization, review and modify the script to redact sensitive fields, or run it in an isolated/test environment.

Type: OpenClaw Skill Name: business-api-recorder Version: 1.0.0 The skill bundle implements a browser-based network interceptor in `scripts/network-monitor.js` that hooks global `fetch` and `XMLHttpRequest` objects to capture all network traffic, including request headers (which often contain authentication tokens) and full response bodies. While this behavior is aligned with the stated purpose of 'Business API Recording' and documentation generation in `SKILL.md`, the broad interception of sensitive data from 'internal systems' represents a high-risk capability. The tool includes a helper script `scripts/get-monitor.sh` to facilitate the injection of the monitoring code, and although it logs actions to the console, the potential for capturing and storing sensitive credentials or PII makes it a significant security risk if used on untrusted or sensitive platforms.