browser-cdp

Warn

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The setup-cdp-chrome.js script executes a wide array of system-level commands to discover and manage browser processes and network ports across macOS, Linux, and Windows. This includes calls to pgrep, pkill, taskkill, wmic, powershell, lsof, ss, and fuser.
  • [CREDENTIALS_UNSAFE]: The skill's primary functionality includes the extraction of sensitive credentials. It explicitly provides commands to retrieve localStorage tokens and browser cookies (agent-browser --cdp 9222 eval 'localStorage.getItem("token") || document.cookie'), which poses a significant data exposure risk.
  • [EXTERNAL_DOWNLOADS]: The skill instructions require the user to install a third-party global Node.js package, agent-browser, from an external registry to enable the browser automation features.
  • [PRIVILEGE_ESCALATION]: The setup script performs intrusive actions that affect the entire user session, such as terminating all running Google Chrome processes and creating a complete copy of the user's Chrome profile directory (containing history, saved passwords, and sessions) into a secondary debugging folder.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 7, 2026, 01:44 PM