agent-browser-automation

BENIGN. The skill’s capabilities match its stated browser-automation purpose, and data flows are consistent with controlling Chrome and saving browser state locally. Main risk is supply-chain/install trust: the documented npm install triggers native binary download, and Chrome is fetched separately, so users are executing downloaded binaries with limited end-user verification. Publisher attribution via ara.so is indirect but evidence ties the tool to vercel-labs rather than an unrelated third party.