Aipex Browser

AI-powered browser automation using the AIPex Chrome Extension via MCP bridge. Use this skill when the agent needs to control a Chrome browser — navigating p...

This skill is coherent for controlling a Chrome browser, but it relies on running `npx -y aipex-mcp-bridge` (runtime download-and-execute from the npm registry) and grants the bridge broad access to all browser tabs and form content. Before installing: (1) verify the AIPex Chrome extension source (prefer the official Chrome Web Store listing), (2) inspect the aipex-mcp-bridge package repository and prefer a pinned version or checksum instead of `-y` latest, (3) consider installing/running the bridge manually in an isolated environment first, (4) avoid using the skill on pages that contain sensitive data (banking, cloud consoles, secret editors) unless you fully trust the extension and bridge, and (5) if you need stricter guarantees, request the publisher to provide a fixed release URL, signed artifact, or repository link and installation instructions that do not auto-execute unpinned remote code.

Type: OpenClaw Skill Name: skill-6 Version: 0.1.0 The skill is classified as suspicious due to its reliance on `npx -y aipex-mcp-bridge` for setup, as detailed in `SKILL.md`. This command instructs the agent to download and execute an external npm package, introducing a supply chain vulnerability and a potential remote code execution (RCE) risk if the `aipex-mcp-bridge` package or its registry were compromised. Additionally, the `references/tools-reference.md` reveals powerful capabilities like the `computer` tool, which grants full keyboard and mouse control, and `download_*` tools, allowing arbitrary file saving to the local filesystem. While these capabilities are intended for legitimate browser automation, they present significant vectors for misuse if the agent were to be compromised via prompt injection or if the external dependency were malicious.