confluence-update

Warn

Audited by Socket on May 19, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/atlassian-browser.js

This module is primarily legitimate-looking DevTools automation for SSO/session verification, but it includes a powerful credential-harvesting primitive: it extracts real authentication cookies from a local Chromium session via CDP Network.getCookies and supplies them to caller code. It also launches the browser with permissive remote-debugging/origin relaxation (--remote-allow-origins=*), which increases potential impact if the local debugging port is reachable or misused. No explicit malware/exfiltration to remote domains is present in this snippet, but the capability is sufficiently sensitive that the module should be treated as high-risk and used only with strict input control and isolation of the browser profile/debugging context.

Confidence: 60%Severity: 76%
Audit Metadata
Analyzed At
May 19, 2026, 12:17 AM
Package URL
pkg:socket/skills-sh/aholbreich%2Fagent-skills%2Fconfluence-update%2F@5e6a71f4863315eec01a4837d21a3f9361d09418
Security Audit — socket — confluence-update