MoreLogin

Manage MoreLogin anti-detect browser profiles and cloud phones through the official Local API (http://127.0.0.1:40000), including browser profile lifecycle,...

This skill appears to do what it claims: a local CLI to control MoreLogin's Local API. Before installing, confirm you want to run a Node CLI that will: (1) call http://127.0.0.1:40000 (local only) to manage profiles/cloud phones, (2) install Node packages (npm install) which by default will also download devDependencies like Playwright/puppeteer that are large, and (3) optionally use adb (the brew formula installs android-platform-tools). Recommended precautions: run npm install with NODE_ENV=production or remove devDependencies if you only need the CLI; review bin/morelogin.js and common helpers if you want to be sure of specific network calls; do not commit any API tokens or MORELOGIN_TOKEN into repositories—store them in your secret manager if needed; verify the MoreLogin local API port on your system (docs show 40000 in some places and 5050 in others) and ensure MoreLogin desktop is the expected version. If you need a stricter footprint, consider running the CLI in an isolated environment (container or VM) and audit network access during use.

Type: OpenClaw Skill Name: morelogin Version: 1.0.3 The skill is designed to manage MoreLogin anti-detect browser profiles and cloud phones through their official local API (http://127.0.0.1:40000). All network communication from the skill's core logic (`bin/morelogin.js`, `bin/common.js`, `bin/cloudphone-commands.js`) is directed to this local loopback address. Crucially, the `SKILL.md` and `bin/morelogin.js` explicitly state that the `cloudphone exec` command, which could execute arbitrary shell commands on cloud phones, has been removed from this skill. Furthermore, input validation (e.g., regex for `packageName` in `bin/cloudphone-commands.js`) is present to prevent injection. The documentation also includes clear security instructions for the AI agent, such as not exposing sensitive data and adhering to execution guardrails. While `adb` is a required binary, its use is mediated by the MoreLogin local API, and the skill itself does not directly expose raw `adb` command execution to user input. There is no evidence of intentional harmful behavior, data exfiltration to external endpoints, or persistence mechanisms.