feature-doc

This is a browser recording and interaction script, with no evident direct data exfiltration or malware behavior. It has a significant path-safety concern because SR_OUT controls a recursively deleted directory, and untrusted SR_STEPS testid values can be interpolated into JavaScript executed through js(). Browser content and action inputs are saved locally; severity is moderate when these configuration values or browser contents are untrusted.