browser-mate
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/browser.pyscript manages Chrome instances using thesubprocessmodule. - It uses
subprocess.Popento launch the Chrome binary with automation-specific flags (--remote-debugging-port,--user-data-dir). - It uses
subprocess.runto call thepsutility to locate and monitor specific PIDs associated with the managed profiles. - [SAFE]: The skill implements several safety measures to protect the user's environment:
- It explicitly forbids using the user's primary Chrome profile directories (
~/Library/Application Support/Google/Chrome, etc.) as auser_data_dirto avoid data corruption or locking the user's browser. - It validates that ports and data directories are unique across configured profiles to prevent session collisions.
- Network communication for status checks via
urllib.requestis restricted to the local loopback interface (127.0.0.1). - [SAFE]: Instructions for interacting with browsers (e.g., via the
agent-browsertool) follow established patterns for browser automation and do not involve suspicious remote script execution or data exfiltration.
Audit Metadata