browser Devtools Inspector

Inspect and analyze browser DevTools Console, Network, and Performance data to debug frontend issues like errors, failed requests, CORS, and slow loads.

This skill appears coherent for DevTools-style debugging. Before running it: (1) run it locally or in an isolated environment, especially if you will point it at production/internal URLs — the scripts execute page JavaScript and capture console/network output which may include secrets; (2) review any JSON output before sharing; (3) be aware npm install will download Chromium via puppeteer (large download, network access); (4) if you want to avoid auto-downloaded Chromium, set PUPPETEER_EXECUTABLE_PATH to a trusted local Chrome/Chromium binary; (5) avoid running against authenticated endpoints unless you intentionally want the tool to observe authenticated requests and responses; and (6) if you have concerns about visiting untrusted pages, run in a sandboxed environment (VM/container) to limit risk.

Type: OpenClaw Skill Name: qtada-browser-devtools-inspector Version: 1.0.0 The skill is classified as suspicious due to the use of `puppeteer.launch` with `--no-sandbox` and `--disable-setuid-sandbox` arguments in all JavaScript files (`analyze_performance.js`, `capture_console.js`, `capture_network.js`, `check_cors.js`). While this configuration might be used for compatibility in certain environments, it significantly reduces the security posture of the Chromium browser, making it vulnerable to potential sandbox escapes if a malicious URL is visited. Although there is no evidence of intentional data exfiltration, persistence, or other malicious activities within the code or the `SKILL.md` instructions, this configuration creates a critical vulnerability risk (e.g., RCE) if the browser is exploited by a crafted web page.