ego-browser

SUSPICIOUS. The skill's capabilities broadly match its stated browser-automation purpose, and its sensitive-action handoff policy reduces autonomy risk. But its actual footprint is high-risk: it routes agent actions over SSH into the user's logged-in browser on a personal Mac, reaches banking/root/admin surfaces, and depends on a largely unverifiable closed-source binary outside normal registries. This is not confirmed malware, but it is a high-trust skill with substantial security exposure.

No explicit backdoor/persistence/exfiltration logic is evident in this installer/launcher script itself. However, it creates a significant macOS supply-chain risk: it downloads and mounts a remote DMG (and possibly runs an included .pkg) without verifying integrity or authenticity, then removes com.apple.quarantine and performs privileged installation into /Applications before launching. If the CDN content (or transport path) were tampered with, this script would directly deliver and execute the attacker’s payload with elevated installation impact.