kimi-webbridge

SUSPICIOUS: the skill's capabilities largely match its stated purpose, and the installer appears same-org based on Kimi/Moonshot documentation, so this is not confirmed malware. However, it gives an AI agent broad control over the user's real authenticated browser sessions and supports arbitrary page JS execution, uploads, screenshots, and network inspection, creating high real-world action and sensitive-data exposure risk. The official install path also uses curl|bash without clear checksum/signature verification, raising additional supply-chain concern.