install-canvas-capture-browser
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a Chrome for Testing binary from Google's official cloud storage (
storage.googleapis.com). This is a legitimate and well-known source for this specific software. - [COMMAND_EXECUTION]: The bundled installer script executes several standard shell utilities including
curlfor the download,shasumfor integrity verification, anddittofor archive extraction on macOS. - [SAFE]: The installation process includes a hardcoded SHA256 checksum verification step to ensure that the downloaded binary has not been tampered with before it is moved to the applications folder.
- [SAFE]: The skill documentation explicitly warns users that the pinned browser build does not receive security updates and should only be used with trusted websites, demonstrating good disclosure practices.
- [SAFE]: The presence of a hardcoded local path (
/Users/jonathanburger/...) appears to be a leftover from the developer's environment rather than a malicious indicator, though it may cause the script to fail on other systems unless the path is overridden via command-line arguments.
Audit Metadata