by 安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This package appears to be a mismatched or incomplete wrapper: SKILL.md and the description promise many features (Selenium/Puppeteer, proxy pools, scheduling, notifications) that are not implemented in main.py, which only fetches a URL with requests and writes a markdown file. Before installing or using it: 1) don't run it against sensitive/internal sites — it will fetch arbitrary URLs and store their contents locally; 2) inspect and run the code in a sandbox or isolated environment; 3) ask the...详细分析 ▾
⚠ 用途与能力
The skill claims multi-browser Selenium/Puppeteer support, retry/ proxy pools, cron scheduling, email/notification integration and paid task modes. The only executable (main.py) implements a single 'scrape' action using requests, extracting title/links and writing a markdown report. There is no Selenium/Puppeteer, no proxy/retry logic, no scheduling code, and no notification/email integration. package.json is a Node-style file that points to main.py (Python), and _meta.json.ownerId does not match the registry Owner ID — multiple inconsistencies indicate the declared capabilities are disproportionate to the actual code.
⚠ 指令范围
SKILL.md instructs running 'openclaw run web-automation' with multiple actions (cron, test, scrape) and implies integrations (proxies, notifications). The runtime code only supports 'scrape' via python main.py and writes output to a local ./output directory. The SKILL.md gives broad, unsupported instructions and therefore grants expectations that the code does not honor; this mismatch could mislead users about what will run.
✓ 安装机制
There is no install spec (instruction-only + a code file). No external downloads or install steps are declared, which limits supply-chain risk. However, the presence of package.json for a Python script is odd but does not itself install anything.
ℹ 凭证需求
The skill declares no required env vars or credentials, and main.py does not read environment secrets. However, SKILL.md mentions proxy pools and email/notification integrations that would normally require credentials — none are declared or implemented. This is inconsistent: promised integrations would need secrets but none are requested.
✓ 持久化与权限
The skill is not marked 'always', does not request elevated persistence, and there is no code that modifies other skills or global agent settings. It writes reports to a local ./output directory only.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/26
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install ai-web-automation-local
镜像加速npx clawhub@latest install ai-web-automation-local --registry https://cn.longxiaskill.com