Professional Web Intelligence & Automation Toolkit. Features Protocol Phantom (TLS/JA4), Local Socket Relaying, and Hardened physical gating.

This package contains powerful local-browser and relay tools (CDP takeover, driver injection, local TCP/UDS relay) that can execute arbitrary JavaScript inside a browser and forward local traffic. Key concerns: (1) Manifest/instruction mismatches — _meta.json claims a minimal scraper while the code implements high-risk 'nuclear' features; SKILL.md and registry disagree on disable-model-invocation. (2) Undeclared use of environment/config — code expects SOTA_NUCLEAR_CONFIRMED and a lockfile at ~/.openclaw/tmp/sota_active.lock and creates /tmp sockets, but the manifest declares no env vars or config paths. (3) High-privilege operations — Runtime.evaluate via CDP and direct BrowserDriver injection are capable of executing arbitrary payloads in the browser context and interacting with local services. Recommended actions before installing or enabling this skill: run only in an isolated VM/container; require the author to fix manifest and metadata inconsistencies (version, disable-model-invocation, declared bins/python deps, declared config paths and env vars); remove or explicitly justify 'nuclear' scripts if not needed; review and possibly delete/disable scripts that perform CDP takeover or direct driver injection; and confirm ownership/provenance of the package. If you need to trust this skill on a host, obtain explicit answers from the author about gating guarantees and demonstrable proof that the UDS/lockfile gating cannot be trivially bypassed. Additional information that would raise confidence: an updated _meta.json matching the code (including required python deps and config paths), confirmation that disable-model-invocation is enforced at registry/platform level, and documentation/tests proving the gating can't be bypassed.

Type: OpenClaw Skill Name: drission-sota-toolkit Version: 7.1.0 The toolkit provides high-risk browser automation and network relaying capabilities, including raw CDP (Chrome DevTools Protocol) takeover (force_takeover.py) and a local TCP tunnel (python_relay.py). While the bundle includes elaborate 'security gating' mechanisms like Unix Domain Socket handshakes (sota_core.py) and physical lockfiles to prevent unauthorized autonomous execution, the ability to inject low-level drivers and bypass bot detection via impersonation (ultra_experiment.py) represents a significant attack surface. No evidence of intentional data exfiltration or backdoors was found, but the 'nuclear' capabilities and bypass techniques warrant a suspicious classification.