Save All Resource

打开一个可见浏览器，让用户手动浏览目标网站，并在浏览过程中持续监听同域原始响应内容，实时落盘到本地桌面目录。

This skill appears to do what it says: it opens a visible browser and saves same-origin HTTP/HTTPS responses to a folder on your Desktop. Before installing or running it, consider: (1) npm install will download puppeteer and many dependencies and will fetch a browser binary — expect a large network/download and inspect package-lock.json if you want to audit dependencies; (2) anything you navigate while the script runs (including pages behind logins) will be saved locally — avoid visiting sensitive accounts or use an isolated/sandbox environment or a throwaway profile; (3) the saved files live on your Desktop (check disk usage and privacy); (4) if you need stronger assurance, run this in a VM/container or review the puppeteer dependency tree for unexpected postinstall scripts. Overall the skill is internally consistent and contains no obvious remote exfiltration or unexplained credential requests.

Type: OpenClaw Skill Name: save-all-resource Version: 1.0.0 The skill is designed to save website resources to the local filesystem (~/Desktop), which is a high-risk capability. While the logic aligns with the stated purpose, it is classified as suspicious due to a path traversal vulnerability in `scripts/main.js`. The `urlToLocalPath` function fails to strip or validate directory traversal sequences (e.g., '..') after decoding the URL pathname. A malicious website could potentially exploit this to write files outside of the intended desktop directory by serving resources with crafted paths.