web-test

The skill’s browser automation, 1C access, and optional TTS align with its stated purpose; the scanner’s credential and command-injection alerts are not substantiated by the supplied instructions. The principal concern is the unverified optional FFmpeg download and unpinned dependencies. Automated business-changing actions also warrant user authorization and a test environment. Overall: suspicious/moderate security risk, with no evidence of confirmed malware.

This module is a JavaScript automation runner that dynamically executes supplied scripts and exposes browser APIs plus filesystem read/write functions. It contains no direct evidence of malware, credential theft, or data exfiltration, but running untrusted scripts is high risk because execution is unsandboxed and may access ambient Node.js capabilities; timeouts may not stop continued execution. Severity is high when script input is untrusted, and otherwise depends on the caller's trust boundary.

This is a browser-control HTTP handler. Its unauthenticated-looking script execution, screenshot, and shutdown endpoints create significant security exposure if reachable by untrusted clients. The fragment alone does not establish malicious intent; review the execution implementation and deployment access controls.