kimi-webbridge
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands to manage the lifecycle of the Kimi WebBridge daemon (e.g.,
~/.kimi-webbridge/bin/kimi-webbridge start). These commands are standard operations for the skill's stated purpose of providing browser automation via a local binary. - [EXTERNAL_DOWNLOADS]: The documentation references official installation URLs for the browser extension, including the Chrome Web Store and the vendor's own domain (
kimi-web-img.moonshot.cn). These are legitimate resources provided by the skill author for setup and maintenance. - [REMOTE_CODE_EXECUTION]: The
evaluatetool allows for execution of JavaScript within the context of a web page, and thecdptool provides raw access to the Chrome DevTools Protocol. While powerful, these are scoped to the browser environment and are necessary for the skill's primary function of web automation and testing. - [DATA_EXFILTRATION]: The skill interacts with local ports (
127.0.0.1:10086) to communicate with the browser daemon. This is standard local IPC (Inter-Process Communication) and does not involve sending sensitive data to unknown external servers.
Audit Metadata