electrobun-rpc

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation exposes powerful backdoor-capable features: an automatically-injected evaluateJavascriptWithResponse that lets the Bun side execute arbitrary JS in webviews (enabling DOM/cookie/localStorage access and data exfiltration), per-webview AES keys injected into page globals (window.__electrobunSecretKeyBytes) that may be accessible to page scripts, and an unencrypted native bridge fallback and local WebSocket server — together these provide explicit remote-code-execution and data-exfiltration vectors usable for malicious purposes if abused.