social-autoposter

This code is a local CDP screencast/control utility that can capture live screen content (JPEG frames) from a locally running Chrome/Chromium instance and optionally manipulates the UI focus on macOS using lsof + osascript. The fragment does not show direct exfiltration, credential theft, or persistence, but the implemented screen-capture capability is inherently privacy-sensitive and can be used maliciously by downstream code that forwards or stores frames. Review the calling code to see whether screencast.frame() outputs are transmitted or persisted, and ensure only trusted CDP endpoints are targeted.

Overall, this module is primarily an onboarding/telemetry uploader: it collects pending ledger events, normalizes/redacts selected fields, derives an installation identity by executing a local Python helper script, and POSTs the resulting event payload plus an identity header to a configurable backend endpoint. No overt malware behavior is visible in the snippet, but the combination of (1) data egress and (2) runtime execution of a local script introduces meaningful privacy and supply-chain risk that warrants review of scripts/identity.py, ledgerApi, and the completeness/intent of redactMetadata.

No direct evidence of malware (no network activity, credential theft, or backdoor logic) is visible in this fragment. However, it provides a high-impact capability to execute arbitrary commands (spawn with caller-provided cmd/args and env) and performs filesystem reads/writes using paths derived from batchId without validation, which can enable path traversal/file escape if upstream inputs are not strictly controlled. This is best treated as elevated-risk orchestration code rather than inherently malicious, contingent on strong upstream input validation and confinement controls.

No direct evidence of classic malware (no obfuscation, no remote exfiltration, no command-and-control behavior) in this module. However, it is a security-sensitive utility: it exports all browser cookies (authentication/session material) to disk and can inject them into an existing or newly launched Chromium instance via CDP. If cookie files or execution context are compromised, it can enable account/session takeover. Additionally, it launches Chromium with --no-sandbox, increasing risk if the browser is exposed to hostile content.

This code is not overtly malicious in implementation (no obfuscation, no remote exfiltration, no command execution), but it performs a high-sensitivity action: harvesting cookies from an already-running authenticated browser via CDP and writing the cookie values to disk in a reusable format. Security risk is therefore driven by misuse and context (who can run it and where the output file is stored). In a supply-chain context, review whether this dependency is expected to handle cookies and ensure execution/run-time access controls and safe output handling are in place.

No explicit malware is visible in this configuration snippet. The main risks are supply-chain integrity and configuration-driven behavior: it executes `@playwright/mcp@latest` via `npx` (non-pinned/moving dependency, potential runtime acquisition/execution) and loads a user-home JSON config from `~/.claude/...` that could alter agent actions. Review/pin the MCP package version (and ideally use integrity checks) and ensure the referenced config file is trusted and protected from tampering.