ultimate-browsing

SUSPICIOUS: the skill’s capabilities mostly match its stated purpose, but that purpose itself is high-risk. Stealth browsing, WAF/bot-detection bypass, third-party content routing, and local browser-cookie extraction create a broad and sensitive footprint that exceeds normal web-fetch behavior, though there is no clear evidence of outright malware or hidden exfiltration.

This module is highly security-sensitive and aligns strongly with cookie/session hijacking behavior: it decrypts Chromium cookies using OS secret storage, can persist decrypted cookies to a JSON file, and can inject them into another browser/agent via a Node CDP script. The CDP script content is not present, so exact additional behaviors cannot be fully verified, but the visible functionality is already consistent with credential-theft tooling. Recommendation: treat as malicious until proven otherwise, and do not include it in trusted supply chains.

This snippet describes a high-risk stealth automation workflow that goes beyond standard browser testing: it explicitly targets anti-bot evasion and optionally decrypts and reuses real authentication cookies from local OS/browser credential stores by injecting them into a CDP-driven browser session. The snippet itself does not provide proof of remote exfiltration or system-level malware, but the documented session-token harvesting/replay and evasion focus make the overall security risk high. Review the actual implementations (cookie extraction/injection handling and any network communication) before trusting or deploying this tooling in a supply-chain context.

No clear evidence of classical supply-chain malware (credential theft, persistence, reverse shells, or explicit exfiltration destinations) is visible in the provided fragment. However, the design explicitly focuses on WAF/bot/challenge evasion and automation effectiveness: it switches to real Chrome with channel:'chrome', runs headful, and applies stealth plugins, plus it can collect network endpoints to discover backend APIs. This represents a meaningful security/abuse risk even if not demonstrably malicious malware. Review the complete implementation of the referenced executor/templates/validator and any follow-on API calling/curl logic to confirm there is no hidden exfiltration, unauthorized targeting, or unsafe process/network/file behaviors.

This fragment provides concrete automation logic and integration guidance for bypassing WAF/bot protections by impersonating browser TLS/transport fingerprints, spoofing navigation headers (Referer) and maintaining session state, detecting challenge markers in responses, and—most critically—injecting clearance cookies obtained from a real browser challenge solver into curl_cffi to access protected endpoints (including APIs). No clear indicators of classic malware (e.g., command execution or direct data theft code) are present in the snippet, but the capability is strongly usable for security-control circumvention and unauthorized access. Treat as high misuse/security risk for supply-chain contexts.

No definitive evidence of embedded malware (e.g., backdoor, command execution, or credential theft) is present in this module. The dominant security concern is that it accepts untrusted stdin input for navigation targets and directly drives a headless browser (including an extra warmup navigation) to arbitrary destinations, then outputs the fetched HTML to stdout. When deployed in environments with network reachability to internal resources or sensitive pages, this design can enable SSRF-style access and data extraction. The optional stealth plugin and persistent profile usage further increase operational risk. The URL warmup/rootUrl logic appears malformed in the provided fragment, so exact behavior should be validated against the complete source.

This code fragment is a high-risk component that recovers OS-protected Chromium/Chrome master keys (DPAPI, Keychain, Secret Service) and decrypts Chromium v10/v11 encrypted values into plaintext. While no exfiltration is shown in this file, the implemented capability is directly consistent with browser credential/cookie/session theft workflows, making it very suspicious in a supply-chain context.