Skills/npm/jev-browser

jev-browser@0.8.10

CAUTION

Publisher claims: "A Jev-driven browser agent: give it a task and a start URL; typed Choice actions, stop/stuck safety gates, the final page, an auditable step trace, and a screenshot. MCP server, CLI, or library." Observed in sandbox: sends data to registry.npmjs.org.

Registry npm (MCP server)Publisher jkudish · joined 0 days agoInstalls 10,471Last detonated 3 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 50/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: npx invocation of non-well-known package; npx invocation of non-well-known package; File permission modification command. Summary: sends data to registry.npmjs.org.

Behavior trace

Honeypot run · 1 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.7snetworkCONNECT https://registry.npmjs.org
0.7sprocessexec /app/apps/web/node_modules/.bin/npx
0.7sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npx
0.7sprocessexec /app/node_modules/.bin/npx
0.7sprocessexec /pnpm/npx
0.7sprocessexec /usr/local/sbin/npx
0.7sprocessexec /usr/local/bin/npx
0.7sprocessscript backend runs setup only
0.7sprocessscript backend runs setup only

Static findings

HIGH
npx invocation of non-well-known packageREADME.md:61 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageskills/jev-browser/SKILL.md:6 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
File permission modification commanddist/password.js:176 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
npx invocation of non-well-known packageREADME.md:127 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageskills/jev-browser/SKILL.md:54 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packagescripts/ensure-chromium.mjs:17 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageREADME.md:70 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
File permission modification commandREADME.md:228 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
File permission modification commanddist/password.js:62 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
npx invocation of non-well-known packageREADME.md:54 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packagescripts/ensure-chromium.mjs:2 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageREADME.md:44 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
File permission modification commandREADME.md:231 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/http.d.ts:2 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

What would make this Verified

30 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Unclaimed publisher≈ +8 on the totalClaim jkudish: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. npx invocation of non-well-known package≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. File permission modification command≈ +4 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jkudish