Skills/ClawHub/webclaw3-browser-automation

webclaw3-browser-automation@1.0.2

CAUTION

Publisher claims: "浏览器自动化 & 网页抓取（Browser Automation & Web Scraping）——用你自己的 Chrome 和已登录状态干活：搜索、看网页、抓列表、导表格、下载内容、点按钮、填表单、发内容，必须登录才能看的页面也能抓。跑通一次即可提炼成零 token、可定时自动运行的本地 skill，网站改版本地修。English: browser automation & web scraping with your own logged-in Chrome — no re-login, no shared passwords. 中文：浏览器自动化工具 / 网页抓取 / 登录态 / 定时任务。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher fatmind · joined 10 days agoInstalls 1,023Last detonated 2 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 67/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Outbound HTTP to raw IP address; Outbound HTTP to raw IP address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
URL using raw IP addressscripts/cdp-proxy.mjs:857 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressSKILL.md:124 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
CRITICAL
Pipe-to-shell patternscripts/webclaw3.mjs:41 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Process kill commandscripts/webclaw3.mjs:920 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/webclaw3.mjs:380 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellscripts/webclaw3.mjs:41 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:124 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressscripts/cdp-proxy.mjs:857 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:138 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:136 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:139 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Prompt injectionREADME.md:53 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageREADME.md:53 · Authorization escalation language · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
URL using raw IP addressSKILL.md:136 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressSKILL.md:138 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:137 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressSKILL.md:137 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandscripts/webclaw3.mjs:198 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL using raw IP addressSKILL.md:139 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Prompt injectiondocs/workbuddy.md:9 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languagedocs/workbuddy.md:9 · Authorization escalation language · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagedocs/claude-code.md:9 · Authorization escalation language · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagedocs/qoderwork.md:9 · Authorization escalation language · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectiondocs/qoderwork.md:9 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectiondocs/claude-code.md:9 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01

Cost to the agent

Instructions loaded
≈4,732 tok
1 file · 22 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

13 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim fatmind: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  5. URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim fatmindPropose a patch to the maintainer
webclaw3-browser-automation@1.0.2 safety verdict: Caution 67/100 — KillerSkills