cmo-agent

This is a website auditing utility, not evidently malware. Security concerns include unverified TLS fallback, redirect-based access to unintended hosts, unbounded response reads before size checks, and optional npx execution. The undefined epilog variable also prevents the shown CLI from starting. Restrict redirect destinations, retain TLS verification, enforce response-size limits while streaming, and control Lighthouse installation/execution.