RiskShield案件审批自动化

RiskShield 案件审批自动化。使用 Playwright 浏览器自动化完成审批，支持 Pass/Refuse 两种操作。

Things to consider before installing or running this skill: - Inspect secrets: The SKILL.md and multiple scripts include hard-coded credentials (usernames like 'alan.zhang' and a password shown) and the package contains token.json. Do not run these scripts with real or privileged accounts. Remove or rotate any baked-in credentials and delete token.json if it contains real tokens. - Expect npm installs: The README tells you to run npm install/playwright; that will pull code from npm (playwright). The registry metadata did not list an install step — treat that as a mismatch. Run installs in an isolated environment (container or VM) if you must test. - Audit network activity: Scripts make HTTPS requests to riskshield.dcsuat.com and perform actions (approve/refuse). Only run in a test/staging environment where automatic approvals are acceptable. Running against production could perform destructive or unauthorized actions. - Review all bundled files: The skill ships 100+ scripts and helper shells; some call an 'agent-browser' CLI. Verify each script you plan to run; don't execute arbitrary .js/.sh files blindly. - Secrets handling: Prefer passing credentials via environment variables or secure credential stores rather than hard-coding. If you need to use this skill, replace embedded credentials with a safe configuration mechanism and ensure token.json is stored securely or regenerated. - If uncertain, run in a sandbox: Use an isolated container or disposable VM and a test account on the target system. If you want a safer alternative, request a minimal skill that uses explicit credentials (declared in metadata) and a clear install spec.

Type: OpenClaw Skill Name: riskshield Version: 1.0.0 The skill bundle is a collection of automation and debugging scripts designed to interact with the RiskShield case approval system at riskshield.dcsuat.com. It utilizes Playwright for browser automation and direct HTTPS requests for API interactions. While the bundle contains hardcoded credentials (e.g., in SKILL.md and scripts/risk_approve.js) and scripts that extract session tokens and cookies for debugging (e.g., scripts/extract_session.js), these behaviors are consistent with the stated purpose of automating a complex web-based business process. There is no evidence of data exfiltration to third-party domains, malicious persistence, or prompt injection attempts against the OpenClaw agent.