Clarify approval-safe property assessor flow

docs/property-assessor.md

@@ -220,11 +220,21 @@ Good:
 - `node har-photos.js "<url>"`
 - `scripts/property-assessor locate-public-records --address "..."`
 - `scripts/property-assessor render-report --input ... --output ...`
+- `web_fetch` to read an official CAD / assessor page when the TypeScript helper needs a plain page fetch
 
 Avoid when possible:
 
 - `node -e "..."`
 - `node --input-type=module -e "..."`
+- `python3 - <<'PY' ... PY`
+- `python -c "..."`
+- raw `bash -lc '...'` or `zsh -lc '...'` probes for CAD / public-record lookup
+
+Reason:
+
+- OpenClaw exec approvals are path-based, and inline shell / interpreter forms are treated conservatively in allowlist mode.
+- For `property-assessor`, CAD and public-record lookup should stay on the skill’s file-based TypeScript helper path or use `web_fetch`.
+- If the workflow drifts into an ad hoc shell snippet, that is not the approved skill path and can still trigger Control UI approval prompts.
 
 ## PDF report template