browser-cdp

SUSPICIOUS: The skill's browser-control capabilities mostly match its stated purpose, but the explicit token-extraction workflow and reuse of existing login sessions make it high-impact and easy to abuse. Install trust is moderate rather than critical because dependency delivery is via an official npm package tied to the project, though the Node version mismatch shows maintenance inconsistency. Main risk is not malware but powerful access to authenticated browser data and actions.