reddit-voice

The code is not obviously obfuscated or classically malware-like, but it has high-impact “agent” capabilities: it executes dynamically generated JavaScript in a controlled Chrome via CDP eval, performs authenticated Reddit actions, and exports browser cookies to disk (then passes them to yt-dlp). There is no clear direct remote exfiltration to a suspicious domain in this snippet; however, the combination of CDP eval + credential export + process spawning creates a substantial supply-chain and misuse risk. It should be reviewed carefully, run only with trusted agent-browser and in a controlled environment, and treated as sensitive automation tooling rather than a benign dependency.