OpenClaw RPA

Record browser, Excel, Word & API actions once — replay without the LLM: faster, cheaper, no hallucinations. github.com/laziobird/openclaw-rpa . Supports com...

This skill is an RPA recorder/replayer and its code and docs largely match that purpose, but there are two things to watch carefully before installing or running it: (1) it saves login cookies to ~/.openclaw/rpa/sessions/<domain>/cookies.json — these are session credentials that let scripts access sites as your logged-in user, so only keep them if you trust the host and secure the files (restrict permissions, don't check into git); (2) its API-recording flow explicitly supports writing provided API keys directly into the generated .py scripts (plain text). Avoid using the `env`-with-value feature or embedding secrets in chat; prefer letting generated scripts reference environment variables at runtime (os.environ.get) or keep secrets in a protected secrets manager. Additional recommendations: review recorder_server.py and rpa_manager.py for any network uploads before use, run the tool in an isolated environment (VM) if you want to test, ensure the install script's effects (venv creation, playwright installing Chromium) are acceptable, and audit any generated scripts before executing them. If you want to proceed, remove or modify behaviors that auto-embed credentials and consider encrypting/storing cookies securely rather than leaving them as plain JSON in your home directory.

Type: OpenClaw Skill Name: openclaw-rpa Version: 1.3.0 The skill is an RPA framework that records browser and file actions to generate standalone Playwright Python scripts. It contains high-risk capabilities, specifically the 'python_snippet' feature in 'recorder_server.py' which uses 'exec()' to run arbitrary Python code provided by the agent for validation. Additionally, 'rpa_manager.py' uses 'subprocess.run' to execute the generated scripts. While these features are aligned with the tool's stated purpose as an automation 'compiler,' they create a significant attack surface for Remote Code Execution (RCE) if the AI agent is manipulated via prompt injection. No evidence of intentional malice, such as hardcoded data exfiltration or backdoors, was found in the code logic.