Phone Chrome CDP

Control Android Chrome via ADB and raw WebSocket CDP. No Playwright needed for navigate, JS injection, cookies, DOM, scroll, click.

This skill appears to do exactly what it claims, but it grants strong access to the phone's browser: it shows how to run JS in pages and read httpOnly cookies, and it suggests exposing the DevTools port to the LAN. Before using it, consider: - Only run these instructions on devices and networks you trust. Exposing Chrome DevTools (localhost:9222) to other hosts lets anyone on that network fully control the browser and read sensitive data. - Prefer keeping the DevTools endpoint bound to localhost and use an authenticated tunnel (SSH/VPN) if remote access is required, instead of opening it directly to the LAN. - The SKILL.md recommends omitting the Origin header to bypass browser rejection — this is deliberate to connect over ADB but removes a browser protection; be careful when reusing code or adapting it for other environments. - The steps let you read cookies (including httpOnly) and DOM contents and perform clicks/navigation — treat outputs as sensitive and avoid sending them to untrusted endpoints. - Because this is instruction-only, the skill itself doesn't install code, but it runs shell commands (adb, curl) and provides Python code you or an agent would execute. Only run the provided code after reviewing and, if possible, running in an isolated environment. If you want to proceed safely: restrict port forwarding to localhost, avoid direct LAN exposure, require explicit confirmation before any action that forwards ports or reads cookies, and audit any network forwarding tools used for sharing.

Type: OpenClaw Skill Name: phone-chrome-cdp Version: 1.0.0 The skill provides low-level control over Android Chrome via ADB and raw WebSocket communication, specifically bypassing security headers (Origin) to interact with the Chrome DevTools Protocol. It includes high-risk capabilities such as exfiltrating all browser cookies (including httpOnly) and executing arbitrary JavaScript via 'Runtime.evaluate' and 'Network.getAllCookies' in SKILL.md. While these functions are aligned with the stated purpose of mobile browser automation, the combination of ADB shell access and raw socket manipulation for sensitive data access warrants a suspicious classification.