技能详情（站内镜像，无评论）
作者：Anonymous @adminlove520
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.0
统计：⭐ 0 · 151 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：adminlove520/pinchtab-helper
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's declared purpose (controlling a local PinchTab browser service) matches its instructions, but the runtime guidance includes risky install steps (curl | bash from an external domain) and mentions optional remote access tokens that are not declared or constrained.
目的
Name/description claim (control and automate a browser via PinchTab) matches the SKILL.md: all commands and HTTP endpoints are about launching instances, navigation, snapshots, clicks, fills, and screenshots. No unrelated credentials, binaries, or config paths are requested.
说明范围
Instructions are narrowly scoped to running the PinchTab CLI or calling its local HTTP API (http://localhost:9867). They do not instruct reading arbitrary host files or exporting data to third parties. However, the doc suggests using BRIDGE_TOKEN for remote access (not declared as a required env var) and instructs launching a network service — which if misconfigured could expose browser sessions and their data.
安装机制
Although the skill itself has no install spec, SKILL.md explicitly suggests installing via curl -fsSL https://pinchtab.com/install.sh | bash (and alternatives like npm or Docker). Curl|bash from an unverified domain is high risk because it downloads and executes remote code. The npm and Docker alternatives are reasonable, but the guidance to run the remote install script should be treated as a red flag unless the domain and script are audited.
证书
The skill declares no required env vars or secrets (which is appropriate). SKILL.md mentions an optional BRIDGE_TOKEN for remote access; this token is not declared in metadata and would grant broad access if used. Users should not set or expose such tokens unless they understand the security implications.
持久
always is false, no install artifacts are declared, and the skill does not request modifying other skills or system-wide configs. Autonomous invocation is allowed (default) but that is expected for skills and not flagged alone.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Pinchtab Helper」。简介：控制并自动化操作浏览器，支持导航、快照、点击、输入、提交表单和截图，需预先安装并启动 PinchTab 服务。。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/adminlove520/pinchtab-helper/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。