browser-automate

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill downloads and executes a remote shell script directly from a raw GitHub URL belonging to an unverified/unknown account (FinpeakInc), a high-risk pattern for remote code execution and supply-chain malware.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The package executes a remotely-downloaded setup script and then runs a locally-installed frevana binary that can control the user's real, logged-in Chrome (including extracting page data), creating a high-risk supply-chain / remote-code-execution vector that could be abused to exfiltrate credentials or user data.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). High likelihood: the required workflow opens a runtime-supplied URL (e.g., --url in scripts/automate.sh) and then ingests the resulting page “snapshot” (including extracted interactable element text/HTML) into the agent’s LLM context, which can contain outsider-authored free text from arbitrary web content.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). At runtime the bundled scripts/setup.sh fetches and execs remote code from https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh (curl -fsSL ...; exec bash "$setup_file"), and automate.sh calls that setup wrapper before each run, so remote code is downloaded and executed as a required dependency.

---

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports performing a final "place order" / payment click via a dedicated --confirm-payment call. The docs describe a sanctioned flow to submit a single mutating click that finalizes an order (payment), including a concrete CLI example. That is a specific mechanism to execute financial transactions (place orders/payments) rather than a generic browser action, so it grants direct financial execution authority (even though it requires explicit user confirmation).

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill requires repeatedly downloading and running a bundled setup script (which runs the "official Frevana setup script") and starting a local daemon, which can modify the host state by installing software, but it does not explicitly request sudo, edit system-level files, or create user accounts.