chromium-browser
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the Wayback Machine (archive.org) for CDX discovery and Availability API checks. These commands are well-structured, use synchronous execution, and target a well-known service. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
web.archive.organdarchive.org. These are well-known, trusted services for web archival research. The instructions include strict traffic safety protocols, such as stopping all traffic on a 429 error and avoiding parallelization. - [SAFE]: The skill requires a local wrapper at
~/.local/libexec/mcp/chrome-devtools. While it interacts with a local filesystem path, this is framed as a configuration requirement for a specific environment (PRB's attach-only wrapper) rather than a dynamic exfiltration or injection attempt. The instructions explicitly forbid launching new browsers or modifying client configurations.
Audit Metadata