firefox-browser

The skill is purpose-aligned but high risk: it grants an AI agent broad control over the user's real authenticated browser, supports autonomous credential fill from a local Bitwarden-based vault, and can upload local files or act on untrusted web content. This looks more like a powerful browser-operating capability than malware, but the combination of autonomous login, arbitrary site actions, and prompt-injection exposure makes it suspicious/high-risk for agent use.

No explicit malware/backdoor behavior is evident in the provided fragment (no unsafe code, no obvious covert C2, no obfuscated payloads). However, the host has high-impact capabilities: it can unlock/sync a vault, decrypt credentials, optionally gate with fingerprint, and then send credentials to the browser extension; it also reads arbitrary local files from paths provided in incoming WebSocket messages and base64-transmits them via native messaging to the extension. Additionally, large WebSocket limits can enable DoS. Treat as a security-sensitive component: ensure the localhost WebSocket trust boundary is strictly controlled (only the intended extension/clients can connect) and that file-path inputs are constrained/validated in other parts of the project.

SUSPICIOUS due to high-impact autonomous browser control over the user's authenticated Firefox session and vault-assisted login, but the capabilities are largely aligned with the stated purpose. No clear evidence of malware or deceptive third-party credential routing is shown; the main issue is that this skill grants powerful account-level actions and access to sensitive session data.

No direct obfuscated payloads or self-contained malware behavior are evident in this snippet (no eval/Function, no hardcoded credentials, no direct exfiltration to external domains). However, it is a high-impact “privileged bridge” that connects to a native host and forwards native-supplied actions/parameters to powerful browser operations and content-script messaging, including 'evaluate' routing and returning sensitive artifacts like screenshots and download URLs. This design could be abused if the native host (or content.js) is malicious or if the action surface is insufficiently validated/permission-scoped.

No overt malware/obfuscation is visible in this snippet, but it is a high-privilege bridge: it connects to a native host and allows native-originated commands to control tabs/windows, extract page content, request authentication context, and capture screenshots (including an 'evaluate' command routed to content scripts). It then returns these potentially sensitive results back to the native host. The main security risk is abuse/exfiltration via the native messaging channel and content-script command delegation, especially if the native host is compromised or if 'evaluate' in the content script performs unsafe execution. Additional validation/limits (e.g., chunk size/type, action authorization) are not present in this module.

SUSPICIOUS: the skill's browser-control features broadly match its stated purpose, but its footprint is high-risk because it operates the user's real authenticated Firefox session, supports autonomous login, and exposes arbitrary page/script execution. The main trust gap is the unspecified `browser` bridge executable; without clear registry or signed release provenance, this is too much power for an under-verified dependency.

No definitive malicious behavior (e.g., data theft, reverse shells, cryptomining, or direct exfiltration) is evident in the provided fragment. The dominant concern is operational/supply-chain risk: the harness spawns an external AI agent using `--dangerously-skip-permissions` and relies on prompt-level “sandbox” claims rather than enforcing isolation in this code. Because environment variables are forwarded to the child and the agent’s stdout is trusted for metric/event recording, compromised or manipulated agent behavior could cause unintended actions or misleading results. Overall: likely a benchmark/test harness, but executed with materially unsafe semantics for a security-sensitive environment.

This dependency/module functions as an E2E benchmark harness that delegates sensitive browser automation (login, OAuth, and extraction of secret-like values) to an external agent launched with intentionally relaxed safety controls ('--dangerously-skip-permissions'). It forwards the entire environment to the child process and saves unredacted agent output to local JSON artifacts, creating a meaningful risk of secret leakage and sensitive-data persistence if run against anything beyond a strictly isolated test server. No direct malware behaviors (e.g., reverse shells, arbitrary exfiltration) are evident in this module itself, but the orchestration pattern is high-risk and should be treated as security-sensitive.

No clear evidence of embedded malware/obfuscation in this module. However, it functions as an authorization-sensitive IPC-to-network control bridge: any local process that can connect to the Unix domain socket can send arbitrary JSON actions/params that are forwarded to the remote browser-agent bridge (WS_URL) without allowlisting or semantic validation in this code. Additionally, stop() depends on a pid file that could be tampered with, potentially causing unintended process signaling. Overall: high security relevance due to trust boundary exposure rather than direct malicious payload behavior.

This entrypoint does not show explicit obfuscation, hardcoded credentials, or direct malicious payload execution. However, it provides a strong, capability-based data exfiltration primitive: it can read arbitrary local files specified by the caller (including full file bytes), base64-encodes them, and transmits the encoded contents as command parameters to a browser/session component, with additional screenshot and recording persistence that could retain sensitive data. Malware likelihood cannot be proven from this fragment alone, but the security risk is elevated due to the powerful local-to-remote data bridging and persistence/logging behaviors, which could be repurposed for theft if any downstream component or operator workflow is malicious.

This module does not contain classic in-file malware (no eval, no reverse shells, no direct network requests, no destructive file operations beyond writing local results). However, it materially increases supply-chain/agent-risk by delegating browser automation and potential tool use to an external `claude` CLI invoked with `--dangerously-skip-permissions`, while also allowing the target URL to be controlled via `TEST_SERVER`. It additionally persists truncated agent stdout, which could capture sensitive data if the invoked agent/toolchain outputs it. Overall, treat this as potentially risky automation orchestration rather than confirmed malicious code.

This file is primarily a browser-automation benchmark launcher, but it carries significant security-relevant risks: (1) it executes a locally stored script from a mutable path under the user’s HOME directory, enabling tampering/substitution of the executed code; and (2) it uses execSync with a shell command string that embeds user-controlled JSON payload data, creating a credible command-injection risk depending on shell quoting/escaping. No explicit malware behavior is visible in this wrapper alone, but the execution of the companion client.js and the unsafe command-construction pattern warrant review/hardening.

This manifest-only view shows no direct malicious code, obfuscation, or explicit exfiltration endpoints. However, it configures a high-risk capability set: all-sites/all-frames content injection plus broad permissions (tabs/webNavigation/webRequest/downloads/storage) and native messaging to an external native host. This substantially increases the impact of any abusive behavior in the referenced background.js/content.js or native host components; those components are required for a definitive malware assessment.

This manifest alone does not prove malware, but it configures a highly privileged “agent bridge” extension: it injects a content script into all pages and all frames and enables nativeMessaging to a local host. That combination is a significant potential risk area for data exfiltration or command/control behavior if the unseen background/content logic or native host is unsafe. Review background.js, content.js, popup handling, and the native messaging host implementation for strict origin/permission checks, minimization of data sent to the native host, and absence of arbitrary page-data exfiltration.