setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The Chrome Web Store link is an official store listing (low risk) but the direct GitHub release ZIP is a developer-distributed archive (vibe-ai-copilot-latest.zip) which can easily contain malicious code and is therefore a suspicious download source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This document describes enabling a browser extension and a bearer UUID that grants remote control (including "eval", DOM access, tab listing, screenshots and URL/text retrieval) of a user's Chrome instance—features that directly enable data exfiltration, credential capture, and remote code execution if abused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and running remote extension/package code at runtime (Chrome Web Store install: https://chromewebstore.google.com/detail/vibe-ai-browser-co-pilot/djodpgokbmobeclicaicnnidccoinado and the developer ZIP: https://github.com/VibeTechnologies/VibeWebAgent/releases/latest/download/vibe-ai-copilot-latest.zip), which fetches and executes external code the agent depends on.