antithesis-agent-browser

This is a purpose-built log-download automation wrapper, and there is no direct evidence of intentional malware in the bash logic itself (no hardcoded secrets, no obvious exfiltration endpoints, no reverse shell/persistence). However, it has meaningful security risk due to (1) arbitrary URL navigation with only weak page verification, (2) dynamic browser-context code execution via eval with injected runtime, and (3) writing downloaded page-selected content verbatim to an arbitrary caller-chosen destination. The main supply-chain/abuse concern is that if the target page or the injected runtime is tampered with, the automation could execute attacker-controlled JavaScript in the browser session and produce attacker-influenced output files.