Actionbook

• Analyzed: May 12, 2026, 3:49 AM
• Findings: 1
• Version: 0.1.1
• Hash: 1b09dafbb6b3ee6f670ef5c90df7739f6cfd6d786ae5efb5bacd96a13e93e627
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its extensive high-risk capabilities, which, while intended for legitimate browser automation, could be easily abused. Key indicators include the `actionbook browser eval "JavaScript code"` command (found in `references/command-reference.md`), allowing arbitrary code execution within the browser context, which is a significant remote code execution (RCE) risk. Furthermore, the skill provides comprehensive browser control, including full access to page content (`text`, `html`, `snapshot`), cookie management (`cookies set/get`), and the ability to connect to existing browser sessions (`--cdp`) or use custom browser executables (`--browser-path`). While the documentation in `references/authentication.md` provides security best practices, these powerful features create a substantial attack surface for data exfiltration, session hijacking, or other malicious activities if the AI agent is compromised or prompted maliciously.