web-access

该 skill 的核心能力与“联网/真实浏览器访问”目的基本一致，不像伪装型窃密工具；但其作用域非常宽，复用用户登录态、读取浏览器历史/书签、支持文件上传与账户内操作，并要求子 Agent 加载同一 skill，带来明显的账户操作与外部内容注入风险。整体更适合归类为高权限且中高风险的浏览自动化技能，而非恶意软件。

This module is a powerful CDP proxy exposing endpoints that allow attacker-controlled browser automation. The most significant risk is /eval, which executes arbitrary JavaScript in the browser via Runtime.evaluate using untrusted input, plus /new and /navigate enabling attacker-controlled URL navigation. Additionally, /screenshot can write to an attacker-controlled filesystem path (fs.writeFileSync(q.file)) without visible path restrictions. No authentication/authorization is visible for these endpoints. While it may be intended for local automation, the capability set is highly misuse-prone and could enable local attackers (or misconfigurations that expose localhost) to perform unauthorized actions and data access.

Based on the described API capabilities, this dependency/package is a high-risk CDP proxy control plane. It enables remote parties (who can reach the HTTP service) to execute arbitrary JavaScript in a live browser context, navigate to arbitrary URLs, perform interactive actions, inject host local files into web forms, and write screenshots to caller-chosen host paths. While the fragment does not prove covert malware (no explicit backdoor/C2/data exfil implementation shown), the interface is inherently abusable and should be treated as a powerful local admin-equivalent component requiring strict access control (localhost-only binding, authentication/authorization, allowlists, and strong path/URL validation).