Turn any website into a CLI command. 36 platforms, 103 commands — Twitter, Reddit, GitHub, YouTube, Zhihu, Bilibili, Weibo, and more. Uses OpenClaw's browser...
Security Analysis
medium confidenceThe skill's stated purpose (turn websites into CLI commands via the bb-browser binary) is mostly coherent, but the runtime instructions include open-ended actions ("reverse-engineer", "test it, and submit a PR") and rely on the user's browser login state without declaring how external actions (e.g., submitting a PR) will be authenticated — these mismatches merit caution.
The name/description match the instructions: the skill is an instruction-only wrapper that runs bb-browser commands through OpenClaw's browser. Requiring the bb-browser binary is proportionate. However, the SKILL.md claims it will create and submit adapters (PRs) which implies additional capabilities (git/GitHub access) that are not declared.
The SKILL.md tells the agent to run bb-browser through OpenClaw's browser and to use the user's login state for sites that require authentication — that is expected for scraping. But it also instructs the agent to "reverse-engineer the API, write the adapter, test it, and submit a PR," a vague, high‑authority instruction that grants the agent broad discretion to browse, scrape, create code, and interact with third‑party services. There are no details on how PR submission/authentication is performed.
Instruction-only skill with no install spec or code files; lowest install risk. It assumes bb-browser is already installed on the host (declared in requires).
The skill declares no required environment variables or credentials, which is reasonable for read-only scraping. But because the instructions mention submitting PRs, the skill may need Git/GitHub credentials or access to user git config — those are not declared. Also, using the OpenClaw browser means the skill will run with any logged-in sessions present, potentially exposing private account data while executing adapters.
always is false and there is no request to modify other skills or system-wide settings. The skill does not claim persistent installation or elevated platform privileges.
Guidance
This skill looks like a legitimate bb-browser wrapper but has two things to confirm before installing: (1) Understand bb-browser provenance — ensure the bb-browser binary you have is from a trusted source because the skill will execute it and it drives the browsing/scraping. (2) Clarify how adapter creation and "submit a PR" are authenticated: the SKILL.md does not declare GitHub or git credentials, yet it promises to submit PRs — ask the maintainer how that flow works and whether the agent will prompt you for tokens or reuse local git config. Also be aware that running adapters with --openclaw uses your browser's login sessions, so it can access private data on sites where you are logged in; consider testing with throwaway accounts or in a sandbox, and avoid enabling autonomous invocation if you don't want the agent to perform broad, automated actions (create adapters, open pages, or push changes) without explicit approval.
Latest Release
v0.1.0
Initial release: Instantly turn 36 websites into CLI commands via OpenClaw, no Chrome extension needed. - 103 prebuilt commands covering social media, developer, news, finance, video, and more. - Uses OpenClaw’s browser for authentication and automation; works with your login state. - Filter and format output using --jq for structured data on the command line. - Includes commands for listing, recommending, and searching adapters. - Detailed guide for creating new adapters.
More by @yan5xu
Published by @yan5xu on ClawHub
