kimi-webbridge

The browser-control capabilities broadly match the stated purpose, and the documented network calls remain local. The main concern is the unverified required daemon binary, compounded by extensive access to authenticated browser sessions and page-action capabilities. No confirmed credential theft, external exfiltration, or malicious intent is evident.