browser-bridge

该技能的能力与“真实浏览器桥接/网页自动化”声明基本一致，未见明显凭据窃取或把数据转发到异常第三方域名。主要风险来自高权限浏览器控制能力、任意页面 JS 执行，以及要求手动加载未审计的本地 Chrome 扩展；整体更像高权限自动化工具而非明显恶意技能，判定为 SUSPICIOUS。

This module exhibits a strong remote-control/backdoor pattern: it accepts arbitrary JavaScript over a WebSocket channel, executes it in targeted browser tabs using eval/AsyncFunction in the page MAIN context, escalates to chrome.debugger Runtime.evaluate for CSP/context bypass, and sends execution results plus tab browsing metadata back to the controller. The localhost-only WebSocket reduces exposure to the wider network, but does not mitigate the fundamental high-risk behavior (remote code execution + privileged debugger usage + data transmission).

This fragment is strongly indicative of sensitive cookie harvesting. It requests cookies for the currently active tab via privileged extension messaging, displays raw cookie values in the UI, and copies the resulting cookie header string to the system clipboard. While the snippet shows no direct network exfiltration or obfuscation, the handling of authentication/session cookies and clipboard export are high-risk and could enable session hijacking/credential misuse if the extension is malicious, overly broad, or lacks strong user consent/necessity controls.

This module is highly suspicious and likely security-relevant: it explicitly removes the page’s CSP meta tags and establishes a DOM-triggered channel that forwards untrusted JSON commands to a Chrome extension with capabilities suggestive of sensitive data access (cookies) and powerful browser control/debugging (CDP/tabs/batch). It also reflects extension responses back into the page DOM, creating a data exposure path. Treat as a potential backchannel/data theft mechanism unless the extension’s behavior is independently verified as legitimate for a narrow user workflow.