Web Pilot

Search the web and read page contents without API keys. Use when you need to search via DuckDuckGo/Brave/Google (multi-page), extract readable text from URLs...

Use this only if you are comfortable running a local browser automation tool. Prefer an isolated environment, avoid logged-in or sensitive sites unless you directly control each action, close browser sessions when finished, and avoid untrusted downloads until filename confinement and TLS verification behavior are fixed.

Type: OpenClaw Skill Name: web-pilot Version: 1.0.0 The skill bundle is classified as suspicious due to several high-risk capabilities that, while part of its stated functionality, introduce significant vulnerabilities if misused. Specifically, `scripts/download_file.py` and `scripts/browser_session.py` allow writing files (downloads, screenshots, PDFs) to arbitrary paths on the host system, which could lead to arbitrary file write vulnerabilities. Additionally, `scripts/browser_session.py` includes an `eval` action that permits arbitrary JavaScript execution within the browser context, posing a risk for client-side data theft or browser exploitation. `scripts/download_file.py` also weakens security by falling back to `verify=False` for SSL errors. These are powerful primitives that could be exploited via prompt injection against the AI agent, but there is no clear evidence of intentional malicious behavior (e.g., covert exfiltration, persistence mechanisms) within the code itself.