Sf Scraper

Scrape employee data from a logged-in SAP SuccessFactors browser session using browser automation. Use when: user provides an employee ID and wants employee...

This skill does what it says — it uses the Browser Relay to read and interact with your logged-in SuccessFactors session. Before installing or enabling it: 1) Only enable it if you fully trust the skill owner and understand company policy about scraping employee data. 2) Be aware it can see anything in the attached Chrome profile (open tabs, cookies, session state). 3) Prefer to use it with explicit user invocation only (avoid allowing autonomous runs). 4) Test first on a non-sensitive/demo account to validate behavior. 5) Remove/disable the Browser Relay extension or detach the session when not actively using the skill. 6) If in doubt about legality or privacy, consult your security/privacy team before using.

Type: OpenClaw Skill Name: sf-scraper Version: 0.1.0 The `sf-scraper` skill uses browser automation with full control over the user's authenticated Chrome session (`profile="chrome"`) to scrape sensitive employee data from SAP SuccessFactors. While the `SKILL.md` instructions explicitly state to avoid malicious actions and respect permissions, the dynamic construction of URLs (e.g., `targetUrl="{base_url}/sf/liveprofile?selected_user={employee_id}"`) and typing of user-provided input (`employee_id`) into web forms presents a high-risk capability. If the OpenClaw agent fails to sanitize these inputs before passing them to the `browser` tool, it could lead to client-side vulnerabilities like Cross-Site Scripting (XSS) within the user's browser session. This potential for exploitation through platform vulnerabilities, despite the skill's lack of explicit malicious intent, classifies it as suspicious.