SurfAgent

• Analyzed: Apr 1, 2026, 4:56 PM
• Findings: 1
• Version: 1.0.0
• Hash: eb6500079e5e3150d42e294928abdd67268ea5ae425ef221100d00dce69ac208
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides an AI agent with extensive control over a user's local Chrome browser, including high-risk capabilities such as reading and setting browser cookies (`browser_cookies`) and executing arbitrary JavaScript (`browser_evaluate`) within the page context. While these features are aligned with the stated purpose of advanced browser automation and session persistence, they grant the agent access to sensitive login data and the ability to perform actions on the user's behalf. The reliance on an external local daemon and an MCP server (`surfagent-mcp`) further expands the attack surface, as documented in SKILL.md and README.md.