← 返回
未分类 中文

Token Efficient Web Operations en

Operate web page elements via CDP and Page JS Extension, save 95% Token (for UI automation testing ONLY, NOT a web browsing tool)
通过CDP和页面JS扩展操作网页元素,节省95% Token(仅用于UI自动化测试,不是网页浏览工具)
tangjing tangjing 来源
未分类 clawhub v1.0.1 1 版本 100000 Key: 无需
★ 0
Stars
📥 588
下载
💾 0
安装
1
版本
#latest

概述

Page JS CDP Web Operation Skill

⚠️ Important Notice

This Skill is designed EXCLUSIVELY for browser automation testing scenarios.

This is NOT a tool for daily website browsing or general web access.

🎯 Purpose & Scope

✅ Designed for:

  • Automation testing environments (CI/CD pipelines)
  • UI test script development and validation
  • Page function verification during development
  • Automated regression testing
  • Web scraping of PUBLIC information only

❌ NOT Designed for:

  • ❌ Daily website browsing
  • ❌ Personal web automation assistant
  • ❌ Handling personal accounts or credentials
  • ❌ Automating personal workflows on websites
  • ❌ Any production use involving real user data

🔒 Privacy Field Policy

Strict Rules for Sensitive Fields (password, hidden, file):

ActionAllowed?Condition
-----------------------------
Read valueNEVERExtension code skips these fields during collection
Write value⚠️ User instruction ONLYRequires EXPLICIT user command, never auto-collected

Technical Guarantee:

// In collectAllElements() - sensitive fields are NEVER collected
const sensitiveTypes = ['password', 'hidden', 'file'];
if (element.tagName === 'INPUT' && sensitiveTypes.includes(element.type)) {
  return;  // Skipped - not indexed, not searchable
}

What this means:

  • Password/hidden/file fields cannot be discovered via searchElementsByKey()
  • They can only be operated via direct DOM commands with explicit user instruction
  • Example: document.querySelector('input[type="password"]').value = 'xxx' requires user-provided selector
  • The extension never proactively reads these fields

Dependencies

This Skill must be used with the following components:

  1. Page JS Extension - Chrome Extension (manual installation required)
    • GitHub: https://github.com/TangJing/openclaw_access_web_page_js
    • Please download and review source code before installation
    • Installation: chrome://extensions/ → Developer mode → Load unpacked
  1. CDP Environment - Chrome DevTools Protocol access
    • Local: http://127.0.0.1:9222
    • Or automation frameworks like Puppeteer/Playwright

Workflow

  1. Check Extension → Verify ElementCollector is injected (first time only)
  2. Get Element Index → Call exportData() to get element key list (non-sensitive)
  3. AI Analysis → Identify target elements by keys (buttons, inputs, etc.)
  4. Execute Operation → Perform click/input operations via CDP

⚠️ Security Restrictions

Prohibited Page Types

DO NOT use this Skill on:

  • 🔒 Banking/financial websites
  • 🔒 Login/registration pages (involving passwords)
  • 🔒 Payment pages
  • 🔒 Healthcare/medical websites
  • 🔒 Government/ID-related websites
  • 🔒 Any pages containing personal sensitive information

Prohibited Data Types

DO NOT read or modify:

  • Password input fields (type="password")
  • Credit card number inputs
  • National ID number inputs
  • Other sensitive personal data fields

Recommended Operation Scenarios

This Skill is suitable for:

  • ✅ Web operations with public information
  • ✅ Automation testing environments
  • ✅ Non-sensitive form filling (e.g., search boxes)
  • ✅ Button click operations
  • ✅ Dropdown selection operations

Operation Templates

Check Extension Availability (First Launch)

typeof ElementCollector !== 'undefined'
// Returns true if extension is installed

Get Page Element Index (Non-sensitive)

ElementCollector.exportData()
// Returns: { elements: [...keys], keywords: [...], elementCount: N }
// Note: Only returns element key list, not actual DOM content

Click Button

const results = ElementCollector.searchElementsByKey('{button-keyword}');
const element = Object.values(results)[0];
if (element) element.click();

Fill Regular Input (Non-sensitive)

const inputs = ElementCollector.searchElementsByKey('{search-box/input}');
const input = Object.values(inputs)[0];
if (input) {
  input.value = '{value}';
  input.dispatchEvent(new Event('input', { bubbles: true }));
}

Select Dropdown Option

const selects = ElementCollector.searchElementsByKey('{selector-keyword}');
const select = Object.values(selects)[0];
if (select) {
  select.value = '{option-value}';
  select.dispatchEvent(new Event('change', { bubbles: true }));
}

CDP Command Reference

OperationCDP Runtime.evaluate Expression
-------------------------------------------
Check extensiontypeof ElementCollector !== 'undefined'
Get indexElementCollector.exportData()
ClickElementCollector.searchElementsByKey('btn')[0].click()
FillElementCollector.searchElementsByKey('input')[0].value = 'text'
SelectElementCollector.searchElementsByKey('select')[0].value = 'option'

Common Keywords

OperationRecommended Keywords
--------------------------------
Search'搜索', 'search'
Submit'提交', 'submit'
Cancel'取消', 'cancel'
Confirm'确定', 'confirm'
Delete'删除', 'delete'
Edit'编辑', 'edit'
Save'保存', 'save'

⚠️ Privacy & Data Flow

Data Flow

Browser DOM → ElementCollector (Memory Index) → CDP → Local AI Agent
                     ↑
              (Key list only, no sensitive content)

Privacy Notice

  1. Extension Level:
    • ✅ Page JS Extension runs entirely in browser locally
    • ✅ Does not proactively send data to external servers
    • ✅ Data stored in memory, cleared when page closes
  1. Agent Level:
    • ⚠️ AI Agent may send element data to LLM services
    • ⚠️ Element keys may contain page text content (button labels, input labels)
    • ⚠️ Ensure your AI Agent configuration meets privacy requirements
  1. User Responsibility:
    • ⚠️ Users must review extension source code themselves
    • ⚠️ Users must ensure AI Agent won't send sensitive data to untrusted services
    • ⚠️ Users must avoid using this Skill on sensitive pages

Data Scope

Data TypeCollectedOperableDescription
---------------------------------------------
Element id✅ Yes-For indexing
Element class✅ Yes-For indexing
Element title✅ Yes-For indexing
Element innerText✅ Yes-For indexing (max 100 chars)
Regular inputs✅ Yes✅ Read/WriteSearchable, fillable, readable
Password fieldsNot collected⚠️ Write via explicit user command ONLYNever indexed, never readable, can only write with explicit user DOM command
Hidden fieldsNot collected⚠️ Write via explicit user command ONLYNever indexed, never readable, can only write with explicit user DOM command
File uploadsNot collected⚠️ Write via explicit user command ONLYNever indexed, never readable, can only write with explicit user DOM command
Cookie/Storage❌ No❌ InaccessibleExtension has no such permission

Key Points:

  1. Sensitive fields are NEVER collected - They don't appear in exportData() results
  2. Sensitive fields are NEVER readable - No API exists to read their values
  3. Writing requires explicit user command - User must provide exact DOM selector
  4. This extension does NOT auto-fill sensitive fields - No credential handling

Technical Implementation:

// Automatically skip sensitive fields in collectAllElements()
const sensitiveTypes = ['password', 'hidden', 'file'];
if (element.tagName === 'INPUT' && sensitiveTypes.includes(element.type)) {
  return;  // Not collected to index, cannot search via searchElementsByKey
}

Note: Sensitive fields are not indexed but can still be operated via native DOM API with explicit user command (e.g., document.querySelector('input[type="password"]').value = 'xxx'). This extension does not proactively read values from these fields.


Installation Steps

Step 1: Install Page JS Extension

# 1. Download source code
git clone https://github.com/TangJing/openclaw_access_web_page_js.git
cd openclaw_access_web_page_js

# 2. Review source code (recommended)
# Check for:
# - Network request code
# - Data exfiltration logic
# - manifest.json permissions

# 3. Install extension
# Open chrome://extensions/
# Enable "Developer mode"
# Click "Load unpacked", select project directory

Step 2: Install OpenClaw Skill

# 1. Create Skill directory
mkdir -p ~/.openclaw/workspace/skills/page-js-operation

# 2. Save this SKILL.md to the directory
# Path: ~/.openclaw/workspace/skills/page-js-operation/SKILL.md

# 3. Refresh Skills
openclaw agent --message "refresh skills"

Usage Examples

Safe Scenario: Search Operation

# On search engine page
openclaw agent --message "use page_js_operation to fill search box with 'keyword'"
openclaw agent --message "use page_js_operation to click search button"

Safe Scenario: Navigation Operation

# On content page
openclaw agent --message "use page_js_operation to click next page button"
openclaw agent --message "use page_js_operation to select category from dropdown"

❌ Prohibited Scenario: Login Operation

# DO NOT use on login pages
# openclaw agent --message "fill username and password and click login"
# Reason: Involves password fields

Security Best Practices

  1. Use Dedicated Browser Profile
    • Create separate Chrome user profile for automation testing
    • Do not save any real account credentials in test profile
  1. Limit Accessible Domains
    • Restrict accessible domains in extension settings
    • Only allow test environments or public websites
  1. User Confirmation Mechanism
    • Require user confirmation before sensitive operations
    • E.g., form submissions, deletions
  1. Regular Review
    • Periodically review extension code for updates
    • Check Skill execution logs

Technical Notes

ElementCollector Working Principle

// Collection phase
elementMap = Map<key, Element>  // key → DOM reference
keywordMap = Map<keyword, Set<keys>>  // keyword → key set

// key format: id|class|title|innerText
// Example: "login-btn|btn primary||Login"

Why Token Savings

  • Traditional: Send complete HTML (5000-20000 tokens)
  • This Extension: Send element key list only (100-500 tokens)
  • Savings: ~95%+

Disclaimer

By using this Skill, you agree:

  1. You have reviewed and trust the Page JS Extension source code
  2. You understand this Skill is for automation testing ONLY, NOT for daily web browsing
  3. You understand AI Agent may send element data to LLM services
  4. You will not use this Skill on pages involving sensitive information
  5. You understand sensitive fields (password/hidden/file) are NEVER collected or readable
  6. You understand writing to sensitive fields requires explicit user command
  7. You assume all risks of using this Skill
  8. The Skill author is not liable for any data breaches or losses

Intended Use: This Skill is designed exclusively for automated UI testing in development and CI/CD environments. It is NOT a general-purpose web automation tool for personal use.


Links

版本历史

共 1 个版本

  • v1.0.1 当前
    2026-05-02 06:47 安全 安全

安全检测

腾讯云安全 (Keen)

安全,无风险
查看报告

腾讯云安全 (Sanbu)

安全,无风险
查看报告

🔗 相关推荐

dev-programming

YouTube

byungkyu
使用托管OAuth集成YouTube Data API,支持搜索视频、管理播放列表、获取频道数据及评论互动,适用于用户需要时使用此技能。
★ 142 📥 41,536
dev-programming

Github

steipete
使用 `gh` CLI 与 GitHub 交互,通过 `gh issue`、`gh pr`、`gh run` 和 `gh api` 管理议题、PR、CI 运行及高级查询。
★ 677 📥 327,213
dev-programming

CodeConductor.ai

larsonreever
AI驱动平台,提供快速全栈开发、智能体、工作流自动化及低代码AI集成的可扩展产品创建。
★ 72 📥 181,806