by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions generally match a Chrome/MCP management purpose, but there are some inconsistencies and minor risks (notably reliance on runtime npx installs and missing declared binaries) that you should understand before installing.
评估建议
This skill looks like a reasonable set of instructions for managing OpenClaw's built-in Chrome and connecting an MCP client, but note three things before proceeding:
1) The documentation assumes runtime use of npx and mcporter but the skill metadata does not declare those binaries; ensure npx and mcporter exist on your system before relying on these steps.
2) The mcporter examples use `npx chrome-devtools-mcp@latest` (unpinned). That causes a network fetch and execution of code from the npm reg...详细分析 ▾
ℹ 用途与能力
The SKILL.md describes managing OpenClaw's built-in Chrome and a chrome-devtools-mcp MCP server — that matches the name/description. However the instructions assume the presence of tools (npx, mcporter) without listing them in the declared requirements; that mismatch is sloppy and worth flagging because the skill implicitly depends on those tools being available.
ℹ 指令范围
Instructions stay within browser/MCP management (status/open/stop, check local CDP endpoint, configure mcporter). They also recommend using evaluate_script (execute JavaScript) which is normal for automation but can access page local data — this is expected for a browser automation tool but is a sensitive capability. The SKILL.md does not instruct reading unrelated system files or secrets.
⚠ 安装机制
No formal install spec is provided, but the docs instruct using `npx chrome-devtools-mcp@latest` in mcporter/clients. That means runtime code is fetched from the npm registry (latest tag) when mcporter runs. Fetching unpinned packages at runtime can introduce supply-chain risk; the skill does not declare or pin a specific package/version and does not declare npx as a required binary.
✓ 凭证需求
The skill does not request credentials or config paths. It suggests setting non-sensitive environment flags (CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS, DEBUG) which are proportional to the task. No secret-env variables are requested.
✓ 持久化与权限
always is false and the skill is instruction-only; it does not request persistent or elevated platform privileges and does not modify other skills' configs. Autonomous invocation is allowed by default but not combined with other high-risk factors.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/22
Initial release: Manage chrome-devtools-mcp service and OpenClaw's built-in Chrome browser for MCP-based browser automation
● 无害
安装命令
点击复制官方npx clawhub@latest install chrome-devtools-mcp-manager
镜像加速npx clawhub@latest install chrome-devtools-mcp-manager --registry https://cn.longxiaskill.com