🌐 chrome-relay-browser — 技能工具
v1.0.1通过 Chrome Extension relay 控制浏览器。用于控制用户已在 Chrome 中打开并 attach 的标签页，无需启动新浏览器，用户可直接看到操作界面。触发条件：(1) 用户让我操作浏览器 (2) 需要复用用户已打开的页面 (3) 需要截图/填表/点击等操作
2· 393·0 当前·0 累计
by 安全扫描
OpenClaw
安全
medium confidenceThe skill's files and runtime instructions align with its stated purpose (controlling an attached Chrome tab via a local relay) with no obvious mismatches, but there are small operational omissions you should be aware of.
评估建议
This skill appears to do what it says: control an already-attached Chrome tab via a local relay. Before installing, verify the Chrome extension and gateway you will use are from a trusted source (inspect their code if possible). Ensure Node.js is installed and the script's npm dependency ('ws') is installed (the SKILL.md does not declare this). Protect the secrets file (~/.openclaw/secrets/browser-relay.env) — anyone with RELAY_TOKEN and access to the relay port can control attached pages. Avoid...详细分析 ▾
✓ 用途与能力
Name/description, the SKILL.md, and scripts/ctl.js consistently implement control of an already-attached Chrome tab via a local relay. The required env vars (RELAY_TOKEN, RELAY_PORT) and the secrets path map directly to the relay/gateway model described.
✓ 指令范围
Runtime instructions limit actions to connecting to a local relay, issuing Chrome DevTools Protocol commands (navigate, screenshot, evaluate, click, fill, etc.), and reading the declared secrets file. They do not instruct reading unrelated system files or contacting remote hosts beyond localhost.
ℹ 安装机制
No install spec (instruction-only) reduces installation risk. However, the included script requires Node.js and the 'ws' npm module, but the skill metadata does not declare Node or any required binaries/dependencies or provide installation steps for npm packages — an operational omission that may confuse users or lead to failed runs.
✓ 凭证需求
Only RELAY_TOKEN and RELAY_PORT (plus the config file path) are required and those are proportional to a relay-based browser-control capability. No unrelated credentials or broad environment access are requested.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide configs. It only reads its own secrets file and uses local HTTP/WebSocket connections; it does not persist additional system-wide privileges.
⚠ scripts/ctl.js:10
Environment variable access combined with network send.
⚠ scripts/ctl.js:15
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/22
No functional or file changes detected in this release. - Version number updated to 1.0.1. - No content, documentation, or code changes made.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install chrome-relay-browser
镜像加速npx clawhub@latest install chrome-relay-browser --registry https://cn.clawhub-mirror.com
技能文档
通过 Chrome Extension relay 控制已 attach 的浏览器标签页。
前置条件
- 配置 openclaw.json（确保 browser 部分已配置）：
"browser": {
"enabled": true,
"defaultProfile": "chrome-relay",
"attachOnly": true
}
- 安装 Chrome 扩展：
openclaw browser extension install
openclaw browser extension path # 获取安装路径
chrome://extensions，开启开发者模式，加载上述路径- 配置扩展（安装后需配置一次）：
~/.openclaw/secrets/browser-relay.env 读取 RELAY_PORT
- Gateway token: 从 ~/.openclaw/secrets/browser-relay.env 读取 RELAY_TOKEN- Attach 标签页：
使用方法
运行 scripts/ctl.js 控制浏览器：
cd ~/.openclaw/workspace/skills/chrome-relay-browser/scripts
node ctl.js [args]
可用命令
| 命令 | 说明 | 示例 |
|---|---|---|
navigate | 打开 URL | node ctl.js navigate https://baidu.com |
screenshot [path] | 截图 | node ctl.js screenshot /tmp/abc.png |
title | 获取页面标题 | node ctl.js title |
url | 获取当前 URL | node ctl.js url |
evaluate | 执行 JS | node ctl.js evaluate "document.title" |
配置
Token 和 Port 存储在 ~/.openclaw/secrets/browser-relay.env，脚本自动读取：
RELAY_TOKEN- Gateway tokenRELAY_PORT- Relay 端口号
故障排除
- Unauthorized: 检查扩展设置的 Gateway token 是否与 secrets 中的 RELAY_TOKEN 一致
- No tabs: 提醒用户先在 Chrome 中 attach 标签页
- Connection refused: 重启 Gateway 或检查 RELAY_PORT 配置
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制