web-access-openclaw

所有联网操作必须通过此 skill 处理，包括：搜索、网页抓取、登录后操作、网络交互等。 触发场景：用户要求搜索信息、查看网页内容、访问需要登录的网站、操作网页界面、抓取社交媒体内容（小红书、微博、推特等）、读取动态渲染页面、以及任何需要真实浏览器环境的网络任务。

This skill appears to do what it claims (control your local Chrome to fetch/login/operate pages) but it grants powerful access: it connects to your real browser profile (so it can see logged-in sessions, cookies, pages), can run arbitrary JavaScript in page contexts, trigger uploads via local file paths, and runs a background HTTP proxy on your machine. Before installing or enabling it: 1) Verify the source: confirm the upstream GitHub repo and that the packaged files match the official project (the registry shows source unknown). 2) Review the cdp-proxy.mjs and check-deps.mjs code yourself (or have a trusted reviewer) — the code runs locally and exposes /eval which can read sensitive DOM data. 3) Restrict usage: prefer manual invocation and require explicit user confirmation for any write actions (posts, uploads, deletes); consider disabling autonomous invocation if you don't want the agent to call the skill without explicit prompts. 4) Run with an isolated Chrome profile (no sensitive logins) if you must use it, or only enable when needed; stop the proxy process when finished (or monitor localhost:3456 and the proxy log file). 5) If you cannot verify the package source or code, avoid installing or grant it minimal access (use a throwaway browser profile).

Type: OpenClaw Skill Name: web-access-openclaw Version: 1.0.0 The skill provides an AI agent with deep control over a user's active Chrome browser session via a local CDP proxy (`scripts/cdp-proxy.mjs`). It includes high-risk capabilities such as executing arbitrary JavaScript in the browser context (`/eval`), capturing screenshots, and uploading local files to web forms (`/setFiles`). While these features are aligned with the stated purpose of advanced web automation and session reuse for sites like Xiaohongshu, they grant the agent full access to the user's logged-in accounts and sensitive browser data. No evidence of intentional malice or hardcoded exfiltration was found, but the powerful primitives provided represent a significant attack surface if the agent is compromised or misdirected.