full-selfbrowsing@0.9.90
VERIFIED· install onlyPublisher claims: "FSB drives the user's Chrome via the FSB extension and an MCP bridge for live web tasks." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher lakshmanturlapati · publishing for 131 daysInstalls 1,069Last detonated 3d ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 90/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
LOW
Prompt injectionUSAGE.md:25 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01…e releases page, unzip it, then load it unpacked at `chrome://extensions` with `Developer mode` toggled on: ``` https://github.com/fullselfbrowsing/FSB/releases ```…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagescripts/install-host.mjs:3 · npx invocation of non-well-known package — may execute untrusted code
AST06// Detects other MCP hosts via `npx -y fsb-mcp-server install --list`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/install-host.mjs:4 · npx invocation of non-well-known package — may execute untrusted code
AST06// prompts y/n per host, runs `npx -y fsb-mcp-server install --<host>` only on explicit yes.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/install-host.mjs:103 · npx invocation of non-well-known package — may execute untrusted code
AST06'[FAIL] cannot launch `npx -y fsb-mcp-server install --list` -- is Node 18+ on PATH?\n'Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/doctor.mjs:23 · npx invocation of non-well-known package — may execute untrusted code
AST06'active-tab': 'Open a normal http(s) tab (not chrome://, edge://, or the Web Store) and run `npx -y fsb-mcp-server status --watch` to re-attach.',Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Authorization escalation languageUSAGE.md:25 · Authorization escalation language · informational: not an instruction file
AST01…e releases page, unzip it, then load it unpacked at `chrome://extensions` with `Developer mode` toggled on: ``` https://github.com/fullselfbrowsing/FSB/releases ```…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagescripts/doctor.mjs:21 · npx invocation of non-well-known package — may execute untrusted code
AST06bridge: 'Start the FSB extension and run `npx -y fsb-mcp-server status --watch` to confirm ws://localhost:7225 is reachable.',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/doctor.mjs:20 · npx invocation of non-well-known package — may execute untrusted code
AST06package: 'Run `npx -y fsb-mcp-server --version` to confirm npm can reach the package.',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/install-host.mjs:14 · npx invocation of non-well-known package — may execute untrusted code
AST06const NPX = 'npx';Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/doctor.mjs:3 · npx invocation of non-well-known package — may execute untrusted code
AST06// Wraps `npx -y fsb-mcp-server doctor`, parses the failing layer,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageSKILL.md:39 · npx invocation of non-well-known package — may execute untrusted code
AST06…d errors, stale state, missing tab) run `node scripts/doctor.mjs` (which wraps `npx -y fsb-mcp-server doctor`) BEFORE retrying the same call. Read the layered output,…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/doctor.mjs:10 · npx invocation of non-well-known package — may execute untrusted code
AST06// 2 -- could not launch the doctor at all (npx / Node missing)Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈1,815 tok
1 file · 17 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.