wang-ke

SUSPICIOUS. The skill is internally coherent, but its purpose is to defeat online course anti-idle controls through stealth browser automation and unattended action loops. Install trust is mostly standard Python tooling, yet the anti-detection focus and optional third-party webdriver-manager make it a medium-high risk automation/evasion skill rather than a benign helper.

No clear indicators of traditional malware (no exfiltration, credential theft, backdoor persistence, or dynamic code execution) are present in this fragment. However, the code is strongly suspicious from an abuse/policy standpoint: it repeatedly injects synthetic mouse and focus-related events and attempts to auto-play paused videos to keep online sessions active, and it exposes a global control API to manage the automation loop. Primary risk is unauthorized automation/session-activity bypass rather than system compromise.

This module is a Selenium-based browser “session keeper” that repeatedly interacts with a user-supplied web page to resume video playback and dispatch focus/mouse events. It does not show direct malware behavior (no exfiltration, persistence, or credential theft). However, it has meaningful security/supply-chain and abuse signals: it can install selenium at runtime via pip if missing, can download a ChromeDriver binary at runtime via webdriver_manager, and it uses CDP/Chrome options to evade automation detection (navigator.webdriver override). Overall risk is moderate, primarily due to runtime network fetch/install and evasion/idle-avoidance behavior rather than clear malicious payloads.