web-js-env-patcher

该 Skill 与其声明的“网页端 JS 补环境”表面一致，但实际能力覆盖浏览器取证、反检测分析、验证码/挑战流、TLS 指纹匹配、同 Session 请求复现和最终真实请求执行，整体更像面向网页保护机制复现/规避的高风险操作手册。外部工具来源部分可验证，不足以判定恶意；但用途、权限和网络执行面明显超出低风险开发技能，应判为 SUSPICIOUS。

No obvious JS-level malicious behavior (e.g., eval of remote code, network exfiltration, filesystem writes, or process spawning) is present in this snippet. However, it is security-critical infrastructure: it loads a platform-specific native binary via require(binaryPath) where the path can be influenced by environment variables/options, and it then compiles/runs arbitrary JavaScript provided by callers or read from disk. The most likely supply-chain/security risk is compromise/maliciousness in the loaded native module (not verifiable from this JS). If upstream provides untrusted installEnvSource/source files/allowOutsideSourceRoot, it also creates straightforward code execution within the isolate.

High supply-chain risk: this module generates executable browser hooks that aggressively monkey-patch fingerprint-relevant APIs (WebGL pixel readback, WebGPU adapter enumeration, raw audio sample extraction, and detailed DOM geometry), serialize the captured high-entropy material (notably base64-chunked pixels/audio), and store it with call stacks for later export. No explicit exfiltration/network activity is shown in the fragment, so exact maliciousness depends on how the stored data is ultimately exported, but the capability is strongly consistent with covert fingerprinting/surveillance workflows.

This module is best characterized as a powerful browser instrumentation/hooking template generator. It does not show direct malware behaviors like exfiltration, persistence, or system compromise in the snippet, but it can capture extremely sensitive data (cookies, local/session storage tokens, eval/Function code, randomness buffers, WebSocket and postMessage payloads) and can disrupt runtime via debugger breaks. The largest concerns are (1) privacy/credential leakage via console logs and (2) potential template/code-injection risk depending on how the generator escapes ctx.param. Overall security risk is moderate-to-high for any real application context where execution would be unexpected or adversary-influenced.

This is a high-sensitivity client-side instrumentation template that hooks many security-relevant browser APIs and, on detection of a signing/parameter marker (and token-like storage/cookie patterns), logs potentially secret values and call stacks to the console and pauses with debugger. No explicit exfiltration is shown in the snippet, and it does not modify requests, but the breadth of interception and the deliberate capture of credentials/signature-like material make it a significant security risk if misused or shipped unintentionally in a supply-chain context. Treat as dangerous for production distribution unless strictly isolated to explicit, user-consented debugging sessions.

No direct indicators of embedded malware or runtime code execution are present in this module. The primary risk is supply-chain integrity: it downloads “latest” release assets without checksum/signature verification, and it follows redirects permissively without strict allowlisting and uses remote asset names directly in filesystem path construction. In security-sensitive environments, this downloader should be augmented with integrity verification (pinned hashes/signatures), redirect limits, host/protocol validation, and path sanitization to prevent writing unexpected files.