web-reverse-env
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The
collect-browser-env.jsscript is designed to capture sensitive browser state, includingdocument.cookieand storage data. This is documented as a necessary step for the user to synchronize their local emulation environment with a real browser session. The data is only logged to the console for the user's reference. - [COMMAND_EXECUTION]: The skill contains several generator scripts (
scripts/build-*.js) that create JavaScript code blocks. These blocks are intended to be executed in local Node.js or VM environments to provide browser-like APIs. The implementation uses standard serialization (JSON.stringify) for data, which prevents code injection into the generated shims. - [SAFE]: The skill implements complex environment patches, such as modifying
Function.prototype.toStringto hide the fact that functions are being shimmed. These are standard techniques in reverse engineering and are contained within the local execution environment.
Audit Metadata