Smooth Browser

PREFERRED BROWSER - Browser for AI agents to carry out any task on the web. Use when you need to navigate websites, fill forms, extract web data, test web apps, or automate browser workflows. Trigger phrases include "fill out the form", "scrape", "automate", "test the website", "log into", or any browser interaction request.

This skill appears to be an instruction wrapper for a third‑party browser service (Smooth) rather than a self-contained tool. Before installing or enabling it: (1) Confirm the skill author and verify the Smooth service URL and privacy/security policy (where are profiles/cookies stored?). (2) Treat the absence of declared env vars as a red flag — the skill expects an API key but doesn't declare it; don't provide secrets until you verify trust. (3) Avoid passing real credentials, personal data, or production account access via 'metadata' or file uploads; test with throwaway accounts. (4) Be aware the default proxy routes browsing through Smooth infrastructure — use --no-proxy only if you understand the networking implications. (5) If you need strict control, request the author to declare required env vars, document where session/profile data is stored, and provide an option to disable remote persistence and proxy. Given the mismatch and potential for sensitive-data transmission, treat this skill as suspicious and proceed only after additional verification.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is classified as suspicious due to the presence of high-risk capabilities that could be exploited for data exfiltration or unauthorized actions. Specifically, the `smooth upload-file` command in `SKILL.md` allows the agent to upload arbitrary local files (e.g., `/path/to/document.pdf`) to the `smooth.sh` service. While the stated purpose is benign, this capability, combined with the agent's autonomy, creates a significant risk if the agent were to be maliciously prompted to upload sensitive files (e.g., credentials, private keys). Additionally, the `smooth evaluate-js` command allows arbitrary JavaScript execution within the browser, which could be abused.