agent-desk

SUSPICIOUS: the skill’s purpose broadly matches its capabilities, and no explicit credential theft or exfiltration is shown, but it relies on a transitive unverified browser-automation skill and an unverifiable local wrapper that can execute arbitrary browser eval. The GitHub Pages SPA and hidden DOM instructions add mutable-content and prompt-injection trust concerns, making this higher risk than a normal documentation/integration skill.

No direct evidence of malware, credential theft, or data exfiltration is present in the shown fragment; the content appears consistent with a planning/session automation harness. The primary security concern is the repeated use of scripts/browser.js exec eval to execute dynamically constructed code strings that invoke agentAPI methods in a browser/automation context. If any eval string components can be influenced by remote page state, persisted session content, or placeholder substitution, it could enable arbitrary code execution and misuse of the agentAPI’s state-changing capabilities. Review scripts/browser.js and the agentAPI bridge for strict control of eval inputs and robust input validation/sanitization; otherwise treat this pattern as a security alert.