bb-browser
Warn
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to access and extract data from a user's logged-in browser sessions. It explicitly mentions fetching authenticated data, cookies (e.g., Twitter's ct0), and CSRF tokens from platforms like Twitter, GitHub, and Reddit.
- [COMMAND_EXECUTION]: Provides functionality to execute arbitrary JavaScript in the context of an open browser tab using the
bb-browser evalcommand, which could be used to manipulate web pages or steal sensitive information. - [REMOTE_CODE_EXECUTION]: The
bb-browser site updatecommand downloads and integrates community-developed 'adapters' (JavaScript files) from an external repository (bb-sites), which are then executed by the tool. - [COMMAND_EXECUTION]: Instructs the user to expose their browser to remote control by enabling the remote debugging port (
--remote-debugging-port=9222), which creates a significant security surface for potential browser-based attacks. - [EXTERNAL_DOWNLOADS]: References an external Python script (
scripts/twitter-scraper.py) and a community repository (bb-sites) for downloading additional functionality not contained within the skill folder.
Audit Metadata