browser-cdp
Warn
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The
setup-cdp-chrome.jsscript executes a wide array of system-level commands to discover and manage browser processes and network ports across macOS, Linux, and Windows. This includes calls topgrep,pkill,taskkill,wmic,powershell,lsof,ss, andfuser. - [CREDENTIALS_UNSAFE]: The skill's primary functionality includes the extraction of sensitive credentials. It explicitly provides commands to retrieve
localStoragetokens and browser cookies (agent-browser --cdp 9222 eval 'localStorage.getItem("token") || document.cookie'), which poses a significant data exposure risk. - [EXTERNAL_DOWNLOADS]: The skill instructions require the user to install a third-party global Node.js package,
agent-browser, from an external registry to enable the browser automation features. - [PRIVILEGE_ESCALATION]: The setup script performs intrusive actions that affect the entire user session, such as terminating all running Google Chrome processes and creating a complete copy of the user's Chrome profile directory (containing history, saved passwords, and sessions) into a secondary debugging folder.
Audit Metadata