ego-browser

SUSPICIOUS. The skill’s capabilities broadly match its browser-automation purpose, and most scanner hits are documentation/context false positives. The main concern is install/execution trust: Linux is same-repo source-built, but macOS depends on a vendor DMG with limited independent verification, while the runtime also gains access to the user’s authenticated browser state. No clear credential-harvesting, stealth, or unrelated exfiltration behavior is shown.

No explicit malware behaviors (e.g., exfiltration, backdoors, or covert command execution) are evident in this shell script. However, it carries a meaningful supply-chain risk typical of remote installer scripts: it downloads and mounts a hardcoded remote DMG without any integrity/signature/notarization verification, then removes com.apple.quarantine and launches/installs the resulting application with elevated install privileges when required. If the CDN content/transport integrity is compromised, this script would likely install and run the attacker’s payload.