puppeteer-stealth

SUSPICIOUS: the skill is internally coherent, but its core purpose is anti-bot evasion and challenge bypass rather than ordinary browsing. Install trust is relatively normal via npm, and there is no direct credential harvesting or exfiltration shown, but the capability set is inherently high-risk for misuse and enables stealthy automated actions on real websites.

The code is best characterized as stealthy web automation/scraping functionality with explicit anti-bot detection/attempted handling (Cloudflare/CAPTCHA), randomized human-like interactions, and extraction of DOM text. While it does not show direct malware behavior (no obvious credential theft, reverse shell, or exfiltration in this fragment), it carries elevated security risk due to (1) session cookie persistence to disk and re-injection into browser sessions, and (2) caller-influenced filesystem paths for cookie/screenshot storage, which may cause sensitive-data exposure or unsafe file operations if upstream inputs are not controlled. Overall, it is more concerning as a tool that can be misused for bypassing protections rather than as overt self-contained malware.

This JSON config itself shows no overt malware (no embedded code, credentials, or exfiltration logic), but it configures a stealthy headless browser for automated scraping with human-like interaction and explicit CAPTCHA/Cloudflare challenge handling, while saving screenshots. It also disables browser sandboxing, increasing exposure when rendering untrusted sites. The dominant risk is misuse/anti-bot bypass capability and screenshot-based data capture, with an additional technical risk from weakened browser isolation.