Web Pilot

Search the web and read page contents without API keys. Use when you need to search via DuckDuckGo/Brave/Google (multi-page), extract readable text from URLs...

Review this skill carefully before installing. It is a powerful browser automation tool, not just a reader: use it only in isolated environments or with trusted tasks, avoid authenticated or sensitive websites unless you are supervising actions, do not submit forms without explicit review, avoid secrets in search queries, and treat downloaded files as untrusted. The download and persistent-browser implementation should be hardened before use in shared or high-trust environments.

Type: OpenClaw Skill Name: web-pilot Version: 1.0.0 The skill bundle is classified as suspicious due to several high-risk capabilities that, while part of its stated functionality, introduce significant vulnerabilities if misused. Specifically, `scripts/download_file.py` and `scripts/browser_session.py` allow writing files (downloads, screenshots, PDFs) to arbitrary paths on the host system, which could lead to arbitrary file write vulnerabilities. Additionally, `scripts/browser_session.py` includes an `eval` action that permits arbitrary JavaScript execution within the browser context, posing a risk for client-side data theft or browser exploitation. `scripts/download_file.py` also weakens security by falling back to `verify=False` for SSL errors. These are powerful primitives that could be exploited via prompt injection against the AI agent, but there is no clear evidence of intentional malicious behavior (e.g., covert exfiltration, persistence mechanisms) within the code itself.