backlink

SUSPICIOUS. The skill’s browser automation and SEO-research capabilities broadly match its stated purpose, and it includes notable safety constraints around CAPTCHA bypass and submission approval. But its core data path relies on a third-party shared-account proxy for Semrush/Similarweb rather than official vendor endpoints, and it requires transitive installation of another powerful skill plus an external binary/extension. That combination is disproportionate enough to make the skill high-risk even without clear evidence of malware.

This module description is highly security-relevant: it operationalizes automation for third-party form endpoints using runtime DOM inspection to detect and work around human/bot verification (including custom arithmetic/slider checks) and explicitly manages honeytrap fields and session/tab evidence behavior. While it does not provide executable code here (so concrete malware capabilities like exfiltration cannot be verified), the guidance is consistent with anti-bot circumvention/abusive automation, which presents a high supply-chain risk if shipped as part of a dependency.

The visible code appears to be a browser automation and CLI utility module, not malware. Its main security concerns are intentional high-impact sinks: arbitrary child-process execution through run(), browser JavaScript evaluation through openAndEval/openAndExtract, and local persistence of URLs and sampled page content. These are potentially dangerous when exposed to untrusted inputs, but the fragment shows no evidence of covert exfiltration or malicious intent. Review callers and access controls around command arguments, browser expressions, URLs, and generated diagnostic files.

This module is a headless/browser-driven form-filling and (optionally) submission bot. It parses a local profile to generate content, navigates to an external target URL, injects browser-side code to locate a likely submission form, fills fields, detects antibot/captcha/terms, and can click a submit control before probing/classifying the result. While it does not show classic malware primitives (no reverse shell, no system command execution, no hardcoded credentials, no explicit exfiltration to an attacker domain), its behavior strongly aligns with potentially abusive automated submission (spam/bot traffic) and should be reviewed for intended use, access controls, and target-site permissions.

No direct evidence of malware, credential theft, network exfiltration, or filesystem/OS manipulation is shown in the provided fragment. The primary supply-chain security concern is the intentional execution of an embedded page-side function bundle via new Function(DEEP_DOM_JS), which is a sensitive dynamic code execution pattern; because the injected bundle contents are not fully present in the snippet, malicious behavior cannot be conclusively excluded. Overall risk is driven more by the dynamic injection surface and deep text extraction capability than by any explicit malicious payload shown here.

This module functions as an automated web probing/classification CLI with optional local evidence dumping. While there is no clear indication of classic malware (no backdoor/exfiltration/remote execution is evident in the shown code), it carries significant security and operational risk: it disables TLS certificate verification (rejectUnauthorized:false), making fetched HTML susceptible to MITM tampering, and it persists raw remote HTML to disk based on externally supplied targets. Input-driven target selection could also enable unintended probing unless lead validation is strict in the referenced modules. Confidence is moderate due to apparent truncation/corruption and missing helper implementations referenced by this file.

The provided fragment is a browser-side DOM harvesting/scraping mechanism: it auto-runs, scrolls through content, extracts leaf text, uses bounding-geometry heuristics to associate nearby numeric values to link attributes filtered by a caller-provided regex, and exposes harvesting results via window.HARVEST and internal save/log methods. In the shown code, there is no explicit malware (no credential theft, no obvious obfuscation, and no direct network exfiltration endpoints), but the harvesting intent and global exposure are sufficiently suspicious that the overall security risk is moderate—primarily dependent on the unseen implementations of init/grabAny/save for any off-site transmission or persistence beyond the page context.

This module is mainly an orchestrator that performs browser-context dynamic code execution. The most security-relevant indicators are the eval-in-browser sink and the injection of releaseSubmitGuard function source (via toString) into that eval payload, executed with access to globalThis and document. There is no direct evidence of malware (e.g., credential theft/exfiltration) in this fragment alone, but the trust boundary is broad and depends on unseen implementations and session targeting. If session/targeting or the injected function can be influenced by an attacker, the mechanism could be abused for malicious page-context actions or data disclosure via the returned stdout.