Playwright Scraper Skill 1.2.0

Playwright-based web scraping OpenClaw Skill with anti-bot protection. Successfully tested on complex sites like Discuss.com.hk.

This skill appears to do what it claims: local Playwright scripts for normal and 'stealth' scraping. Before installing or running it: (1) review the included scripts yourself—npm install will fetch Playwright and its dependencies and npx playwright install will download browser binaries; run these in an isolated environment if you are cautious; (2) be aware the stealth script intentionally modifies browser fingerprints to evade bot detection—this is the feature, but could be legally or ethically questionable depending on target sites; (3) the docs mention proxy rotation and CAPTCHA services (2captcha) as planned — those would require third-party credentials and introduce additional risk if added later; (4) no credentials are required now, and no hidden network endpoints are present, but only run code from unknown sources if you trust the author or after manual audit.

Type: OpenClaw Skill Name: playwright-scraper-skill-1-2-0 Version: 1.0.0 The skill is designed for web scraping using Playwright, including anti-bot features. However, the `scripts/playwright-simple.js` and `scripts/playwright-stealth.js` files allow arbitrary file writes via environment variables (`SCREENSHOT_PATH` and `SAVE_HTML`). An attacker could craft a prompt to the OpenClaw agent to set `SCREENSHOT_PATH` to a sensitive system path (e.g., `/etc/passwd` or `~/.ssh/authorized_keys`), leading to an arbitrary file write vulnerability. While the skill's code itself does not exhibit malicious intent, this vulnerability could be exploited for denial of service or potentially remote code execution if combined with other flaws, classifying it as suspicious.