kimi-webbridge

SUSPICIOUS: the skill's capabilities largely match its stated browser-automation purpose, and the install source appears same-vendor official rather than an unrelated third party. However, it grants an agent broad control over arbitrary websites using the user's authenticated sessions, including uploads, screenshots, JS/CDP execution, and acting on the user's active tab, creating substantial prompt-injection and real-world action risk. This looks like a coherent but high-impact browser-control skill, not confirmed malware.