browser-automation

SUSPICIOUS: the core Playwright install path is mostly legitimate, but the skill goes beyond normal browser automation by emphasizing Cloudflare bypass, stealth fingerprint evasion, and cookie export/reuse for authenticated scraping. Credential and session handling are aligned with login automation, yet the anti-bot evasion and transferable session artifacts make the overall footprint higher risk than a standard automation guide.

No explicit evidence of classic malware behavior is present in the shown automation fragment. The primary risk is security-hygiene and abuse potential: the workflow automates third-party account login and persists highly sensitive authentication material (cookies and Chrome profile data containing Login Data) to disk, and it performs authenticated scraping-like retrieval of generated media via in-page fetch. If the host or the optional local REST service is exposed or misconfigured, attackers could leverage stolen session artifacts or misuse the privileged automation. Confidence is limited for supply-chain risk because the actual npm dependency implementation is not included.

The provided code is not an overt malware implant in itself; it is a credential/session automation script. However, it materially increases account/API compromise risk by exporting authenticated session cookies (potentially including PHPSESSID/auth_browser) in plaintext to /tmp/vultr_cookies.txt, and it weakens host isolation by launching Chromium with the sandbox disabled. Treat this as highly sensitive automation: protect the cookie file (permissions, encryption, lifecycle), avoid running as root, and add proper 2FA handling if required for the workflow.