web-access
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js scripts (
check-deps.mjsandcdp-proxy.mjs) to manage a background proxy server for browser automation. - [COMMAND_EXECUTION]: Provides an
/evalendpoint that executes arbitrary JavaScript within the browser context to interact with the DOM, which is a core requirement of the skill's browsing functionality. - [COMMAND_EXECUTION]: Uses the CDP
DOM.setFileInputFilesmethod through the/setFilesendpoint, allowing the agent to upload local files to websites as part of automated browser tasks. - [COMMAND_EXECUTION]: Includes a
/screenshotendpoint that allows writing image data to a specified local file path. - [EXTERNAL_DOWNLOADS]: The
cdp-proxy.mjsscript provides instructions and logic to optionally install thewsNode.js package if running on Node.js versions earlier than 22. - [SAFE]: Implements a 'Port Guard' security feature using the CDP
Fetchdomain to intercept and block network requests from web pages targeting the local Chrome debugging port, preventing potential anti-automation or side-channel attacks from malicious sites. - [SAFE]: The skill uses
127.0.0.1for local communication between the agent and the CDP proxy, minimizing external network exposure of the control interface.
Audit Metadata