浏览器搜索技能 - 安全的网页搜索工具 使用本地浏览器进行自动化搜索和内容提取 支持 Bing、Google、Baidu、DuckDuckGo 等公开搜索引擎 无需 API 配置，路径输出受限

This skill appears to do what it says (use a local Chromium via Playwright to grab search result titles/links), but it will write output to any file you point to under your home directory. Before installing or running it: (1) review the browser-search.py code yourself or in a safe environment; (2) never pass a path that could overwrite sensitive files (e.g., ~/.ssh/*, shell profile files, or other secrets); (3) prefer running it in a constrained account or container so the home directory does not contain sensitive data; (4) be aware of TOCTOU/symlink risks — avoid running it where untrusted processes can change files between validation and write; (5) install Playwright and Chromium from official sources and run the tool manually first to confirm behavior. If you need stricter guarantees, request the author add a filename whitelist (e.g., only ~/.local/share/browser-search/*.json), atomic write-to-temp-then-rename behavior, and explicit refusal to overwrite existing files.

Type: OpenClaw Skill Name: browser-search Version: 1.0.7 The browser-search skill bundle is a legitimate tool for automating web searches via Playwright. The code in browser-search.py implements explicit security controls, such as validating that output files are restricted to the user's home directory and avoiding dangerous functions like eval or exec. No evidence of data exfiltration, malicious persistence, or prompt injection was found across the script or documentation.