rust-browser-pilot

该技能整体用途与能力基本一致：它确实是浏览器自动化/抓取工具。主要风险不在明显恶意或凭据外传，而在第三方 CLI 供应链信任、会话文件处理，以及代理对不受信网页执行高权限浏览器操作；因此更适合判定为可疑/中等风险，而非恶意。

This module is primarily a DOM-based article extractor, but its security posture is dominated by a high-risk supply-chain/behavioral primitive: it executes arbitrary JavaScript contained in the externally provided global READABILITY_SCRIPT via new Function. If READABILITY_SCRIPT is tampered with, this becomes direct code execution in the page context. Additionally, it can disclose substantial page content (fallback returns HTML/text) and may leak error.stack to the consumer on failures. No explicit network/filesystem activity is present in this snippet.