PageAgent Browser Enhancement

• Analyzed: May 15, 2026, 6:25 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4356271b833d7c865010d2572890443886fbd4cea6fcdfb129de34fa6bca0d55
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides high-privilege browser automation capabilities by injecting code via the Chrome DevTools Protocol (CDP) and exposing an arbitrary JavaScript execution interface. Specifically, `scripts/page-controller.js` uses `eval()` to implement its `executeJavascript` function, and `scripts/inject-cdp.mjs` facilitates the injection of arbitrary logic into browser targets. While these features align with the stated purpose of 'enhanced DOM manipulation' and appear to be based on the legitimate 'alibaba/page-agent' library, the lack of input sanitization and the inclusion of RCE-capable primitives pose a significant security risk if the agent is manipulated. No evidence of intentional data exfiltration or backdoors was found.