webpage-reader-skill

使用Google Chrome无头浏览器下载和读取网页内容，生成摘要并安全处理临时文件以保护隐私。

This skill appears coherent with its description, but check these points before installing: - The skill will execute Google Chrome headless to fetch arbitrary URLs you supply — that means the host will make outbound network requests to those sites. - If Chrome is missing the skill may run package-manager commands (apt-get/dnf/brew) which can require sudo and may prompt the user; consider installing Chrome yourself beforehand to avoid unintended privilege elevation attempts. - There are minor implementation bugs (macOS detection and Linux distro detection) that may prevent automatic installation — no evidence of malicious behavior, just brittle code. - Logs are written to console; the downloaded HTML is read into memory and returned by the skill. If you plan to process sensitive URLs/content, review the code and consider running the skill in a sandboxed environment. If you want higher assurance, run a quick code review or test in an isolated environment (VM/container) and ensure Chrome is pre-installed so the skill won't attempt package installs.

Type: OpenClaw Skill Name: webpage-reader-skill Version: 0.0.2 The skill downloads and processes webpage content by executing a headless Chrome browser via the `subprocess` module in `webpage_reader.py`. It includes logic to automatically install Google Chrome using `sudo apt-get` or `sudo dnf` on Linux systems, which represents a high-privilege operation. Furthermore, it executes Chrome with the `--no-sandbox` flag, disabling a primary security layer. While these actions are documented and support the skill's stated purpose, the use of administrative privileges and the reduction of browser security boundaries pose a significant risk to the host environment.