Webpage Screenshot

打开指定网页并截图为图片文件。在用户要求对某 URL 截图、保存网页为图片、或需要网页快照时使用。

This skill can do what it says (take webpage screenshots) but its instructions expect you to run a project npm script and to install Playwright via npx — actions that will download and execute code. Before installing or invoking: 1) confirm the repository/script you will run (inspect package.json and the screenshot script) because npm scripts can run arbitrary commands; 2) prefer the MCP/browser snapshot mode if you only need a quick preview and want to avoid installing packages; 3) run npm/npx steps in a sandboxed environment (container/VM) if you must install Playwright; 4) ask the publisher for an explicit install spec or a self-contained script (or a known CLI dependency) so you can review what will be executed. If you cannot inspect the script or do not trust the project source, do not run the npm-based method.

Type: OpenClaw Skill Name: webpage-screenshot Version: 1.0.0 The `SKILL.md` file instructs the AI agent to execute a shell command (`npm run screenshot`) with user-provided arguments (`<URL>`, `[输出路径]`). This pattern introduces a significant shell injection vulnerability if the OpenClaw agent does not rigorously sanitize user inputs before executing the command. While the skill's stated purpose (webpage screenshot) is benign, the direct command execution with unsanitized user input poses a critical risk for arbitrary command execution on the host system, classifying it as suspicious due to this vulnerability.