Python + Playwright 内部后台自动化技能，支持 VPN(L2TP/IPsec) 可配置接入、严格域名白名单、中文指令路由（例如进入评论管理到视频评论、进入文章管理到文章列表）与固定流程执行。用于受控访问内网后台、禁止外网访问并按预设命令执行菜单操作。

This skill implements exactly the advertised automation but requires high privileges and contains surprising/unsafe defaults. Before installing or running it: 1) Do NOT run it on a production or sensitive host; run in an isolated VM/container with no access to your real credentials or network. 2) Remove or replace the committed references/vpn_config.yaml (it contains cleartext VPN credentials) and never keep production secrets in the repo — use a secret manager or pass them via environment only at runtime. 3) Expect to run parts of this as root (VPN setup) — review and approve every command that writes to /etc or changes routing. If you won't grant root, disable AUTO_VPN and avoid running vpn_l2tp.py. 4) Audit and optionally remove proxy usage (HTTP_PROXY/HTTPS_PROXY) so traffic cannot be routed through an attacker-controlled proxy. 5) Note the code reads a fallback rules file in the user's home (~/.openclaw/skills/...), which is cross-skill file access; ensure that file is safe or modify the code to avoid reading outside the skill directory. 6) Review code for bugs and edge cases (e.g., review_comments.py references processed_ids but it is not initialized — this will raise errors). 7) If you intend to use it, replace embedded secrets with templates, document required env vars in registry metadata, and run a manual review and least-privilege deployment (dedicated VM, network restrictions, no sensitive account reuse). If you cannot perform these steps, treat the skill as too risky to run.

Type: OpenClaw Skill Name: internal-admin-playwright Version: 1.0.0 The skill bundle contains high-risk system-level operations and hardcoded credentials. Specifically, `scripts/vpn_l2tp.py` overwrites critical system configuration files (e.g., `/etc/ipsec.conf`, `/etc/ipsec.secrets`, `/etc/ppp/options.xl2tpd`) and terminates system processes like `xl2tpd` and `pppd`, which could disrupt host networking. Additionally, `references/vpn_config.yaml` and `debug/login_test.py` contain hardcoded credentials for a VPN server (172.104.49.25) and an administrative backend (staff.bluemv.net). While these actions align with the stated purpose of automating an internal admin panel via VPN, the intrusive nature of the scripts and the use of `shell=True` in subprocess calls present significant security risks.