go-rod-master
Warn
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation in SKILL.md and examples/stealth_page.go instructs the user to execute 'go run github.com/nichochar/go-rod.github.io/cmd/launcher@latest'. This command fetches and executes code from a personal repository belonging to an individual user ('nichochar') rather than the official 'go-rod' organization or a verified vendor.
- [EXTERNAL_DOWNLOADS]: The skill references a third-party fork of 'puppeteer-extra' located at 'github.com/nichochar/puppeteer-extra' for stealth evasions. Relying on individual forks for security-sensitive functionality like bot-evasion increases the risk of supply chain attacks.
- [COMMAND_EXECUTION]: The skill instructions include multiple shell commands for installing Go packages ('go get') and executing scripts ('go run'), which grant the skill the ability to run arbitrary code in the developer's environment.
Audit Metadata