Skills/npm/po-browse-tool

po-browse-tool@0.0.0-alpha.150

CAUTION· install only

Publisher claims: "MCP server for browser automation using Playwright with profile management, page registry, and multi-browser support" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher agimon-ai · publishing for 253 daysInstalls 32,379Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Host or code assembled from base64 fragments; Privileged sudo command; Host or code assembled from base64 fragments. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commanddist/index.mjs:1 · Process kill command — agent can terminate processes…he existing browser session manually\n2. Or use a different profile name\n3. Or kill the process: kill ${t.pid}`,t.pid,e);if(!await this.cleanupOrphanedLocks(e))thro…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/index.mjs:49 · File type combined with upload action — agent may exfiltrate local data files…rowserId),this.sessions.delete(r),n++);return n}};const hr={"application/json":`.json`,"image/jpeg":`.jpg`,"image/png":`.png`,"text/html":`.html`,"text/plain":`.txt`};function gr(e){return e.trim().replace(/[^a-zA-Z0-9._-]+/g,`-`).replace(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/index.cjs:5 · File permission modification command — agent changes file ownership/permissions…="/tmp/runtime-browse"`,`mkdir -p "$XDG_RUNTIME_DIR" "$XDG_RUNTIME_DIR/pulse"`,`chmod 700 "$XDG_RUNTIME_DIR" || true`,`command -v dbus-daemon >/dev/null 2>&1 && expor…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/index.mjs:52 · File type combined with upload action — agent may exfiltrate local data files…ons.set(t,/* @__PURE__ */ new Set),this.browserConnections.get(t).add(n),console.log(`[WebSocketHub] Connection added: ${n} for browser ${t}`),n}removeConnection(e){let t=this.connections.get(e);if(!t)return;let n=this.browserConnections.g…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.cjs:6 · File type combined with upload action — agent may exfiltrate local data files…s.options.extensionPath])if(t&&await l.default.access(m.default.join(t,`manifest.json`)).then(()=>!0,()=>!1))return t;let t=m.default.dirname((0,b.fileURLToPath)(require("url").pathToFileURL(__filename).href)),n=await this.findPackageRoot(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Host or code assembled from base64 fragmentsdist/index.cjs:52 · Host or code assembled from base64 fragments…`Extension mode PDF generation returned no data`);return await(0,l.writeFile)(i,Buffer.from(o.pdfBase64,`base64`)),this.success(`PDF saved to: ${i}`)}):this.executeWithMode(e.TOOL_NAME,t.pageId,t,async()=>{let e=this.resolvePage(t.pageId),…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/index.cjs:57 · npx invocation of non-well-known package — may execute untrusted code…ess:!0,message:`Tracing stopped and saved`,pageId:t.id,tracePath:r,viewCommand:`npx playwright show-trace ${r}`})):this.error(`Trace path must end with .zip extension`):this.…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/index.cjs:52 · File type combined with upload action — agent may exfiltrate local data files…ons.set(t,/* @__PURE__ */ new Set),this.browserConnections.get(t).add(n),console.log(`[WebSocketHub] Connection added: ${n} for browser ${t}`),n}removeConnection(e){let t=this.connections.get(e);if(!t)return;let n=this.browserConnections.g…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commanddist/index.mjs:5 · Privileged sudo command — agent may execute with elevated privileges…. Please install Google Chrome. macOS: brew install --cask google-chrome Linux: sudo apt install google-chrome-stable`);let n=await this.resolveExtensionPath(e.exten…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Host or code assembled from base64 fragmentsdist/index.mjs:52 · Host or code assembled from base64 fragments…)throw Error(`Extension mode PDF generation returned no data`);return await T(i,Buffer.from(o.pdfBase64,`base64`)),this.success(`PDF saved to: ${i}`)}):this.executeWithMode(e.TOOL_NAME,t.pageId,t,async()=>{let e=this.resolvePage(t.pageId),…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File permission modification commanddist/index.mjs:5 · File permission modification command — agent changes file ownership/permissions…="/tmp/runtime-browse"`,`mkdir -p "$XDG_RUNTIME_DIR" "$XDG_RUNTIME_DIR/pulse"`,`chmod 700 "$XDG_RUNTIME_DIR" || true`,`command -v dbus-daemon >/dev/null 2>&1 && expor…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/index.cjs:1 · Process kill command — agent can terminate processes…he existing browser session manually\n2. Or use a different profile name\n3. Or kill the process: kill ${t.pid}`,t.pid,e);if(!await this.cleanupOrphanedLocks(e))thro…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/index.cjs:49 · File type combined with upload action — agent may exfiltrate local data files…rowserId),this.sessions.delete(r),n++);return n}};const _n={"application/json":`.json`,"image/jpeg":`.jpg`,"image/png":`.png`,"text/html":`.html`,"text/plain":`.txt`};function vn(e){return e.trim().replace(/[^a-zA-Z0-9._-]+/g,`-`).replace(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/index.mjs:1 · File permission modification command — agent changes file ownership/permissions…t as a,v as o,y as s}from"./playwright-test-qSbpSyo8.mjs";import c,{access as l,chmod as u,copyFile as d,link as f,lstat as p,mkdir as m,open as h,readFile as g,readd…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commanddist/index.cjs:5 · Privileged sudo command — agent may execute with elevated privileges…. Please install Google Chrome. macOS: brew install --cask google-chrome Linux: sudo apt install google-chrome-stable`);let n=await this.resolveExtensionPath(e.exten…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/index.cjs:1 · File type combined with upload action — agent may exfiltrate local data files…(e,0),!0}catch(e){return e.code===`EPERM`}}};const ve=[`pnpm-workspace.yaml`,`nx.json`,`.git`];function ye(e=[]){for(let t=0;t<e.length;t+=1){let n=e[t];if(n===`--workspace-root`)return e[t+1];if(n.startsWith(`--workspace-root=`))return n.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.mjs:52 · MCP server using network transport (SSE/HTTP) — data sent over network…i.searchParams.set(`playwright_mcp_connect`,`1`),i.searchParams.set(`playwright_mcp_server`,e),i.searchParams.set(`playwright_mcp_browser_id`,t),i.searchParams.set(`playwright_mcp_navigate`,n),r&&(i.hash=new URLSearchParams({t:r}).toString…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagedist/index.mjs:57 · npx invocation of non-well-known package — may execute untrusted code…ess:!0,message:`Tracing stopped and saved`,pageId:t.id,tracePath:r,viewCommand:`npx playwright show-trace ${r}`})):this.error(`Trace path must end with .zip extension`):this.…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/index.mjs:2 · File type combined with upload action — agent may exfiltrate local data files…googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json`;cacheDir;constructor(e={}){this.options=e,this.cacheDir=P(ue(),`.cache`,`chrome-for-testing`)}async getExecutablePath(){let e=this.options.executablePat…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.mjs:1 · File type combined with upload action — agent may exfiltrate local data files…(e,0),!0}catch(e){return e.code===`EPERM`}}};const dt=[`pnpm-workspace.yaml`,`nx.json`,`.git`];function ft(e=[]){for(let t=0;t<e.length;t+=1){let n=e[t];if(n===`--workspace-root`)return e[t+1];if(n.startsWith(`--workspace-root=`))return n.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.cjs:52 · MCP server using network transport (SSE/HTTP) — data sent over network…i.searchParams.set(`playwright_mcp_connect`,`1`),i.searchParams.set(`playwright_mcp_server`,e),i.searchParams.set(`playwright_mcp_browser_id`,t),i.searchParams.set(`playwright_mcp_navigate`,n),r&&(i.hash=new URLSearchParams({t:r}).toString…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/index.mjs:6 · File type combined with upload action — agent may exfiltrate local data files…r(let t of[e,this.options.extensionPath])if(t&&await c.access(A.join(t,`manifest.json`)).then(()=>!0,()=>!1))return t;let t=A.dirname(be(import.meta.url)),n=await this.findPackageRoot(t),r=[n?A.resolve(n,`dist/extension`):``,A.resolve(t,`.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.cjs:2 · File type combined with upload action — agent may exfiltrate local data files…googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json`;cacheDir;constructor(e={}){this.options=e,this.cacheDir=(0,m.join)((0,h.homedir)(),`.cache`,`chrome-for-testing`)}async getExecutablePath(){let e=this.o…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈64 tok
1 file · 21 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @agimon-ai/po-browse-tool@0.0.0-alpha.150 as of 35 min ago. This is the package itself, not its dependencies.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim agimon-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  3. Host or code assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agimon-aiPropose a patch to the maintainer