har-derived-api-client
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses Playwright and standard Python libraries (
requests,httpx,json,argparse) to perform its stated tasks. All scripts operate locally on files provided by the user. - [COMMAND_EXECUTION]: The skill executes Playwright browser automation via the
terminaltool. This is the primary and documented purpose of the skill for capturing network traffic. The actions (click,fill,goto) are controlled by the user via command-line arguments. - [DATA_EXPOSURE]: The skill documentation correctly identifies that HAR files can contain live session secrets (cookies, authorization headers) and advises users to treat them as sensitive data and delete them after use.
- [EXTERNAL_DOWNLOADS]: The skill instructions include installing standard, well-known libraries such as
playwrightviapip. These are official packages from a well-known service (PyPI) and are required for the skill's functionality. - [REMOTE_CODE_EXECUTION]: While the skill connects to remote browsers via CDP (
har_capture_cdp.py), it does so using user-provided endpoints (such as those from Browserbase or Firecrawl). The skill does not execute arbitrary code from these connections; it only monitors network events and drives browser interactions.
Audit Metadata