Security audit
Security checks for vulnerabilities and agentic risk
This is a browser automation instruction skill with powerful but disclosed web interaction features, and no bundled executable code or hidden persistence.
Install only if you want broad browser automation. Be careful with uploads, downloads, form submission, logged-in pages, and the optional Chrome profile because those actions can move local data or act through existing web sessions.
The trigger list includes very generic terms such as '浏览器', '浏览网页', and 'browser', which are likely to match many ordinary user requests and auto-invoke a powerful browser automation skill unnecessarily. Because this skill can navigate, click, upload, download, and execute page actions, accidental routing expands the chance of unintended external interaction or data transfer.
The skill advertises file upload/download and active web interaction capabilities without a prominent warning that these actions may transfer local data to remote sites or cause persistent external side effects. In practice, users or upstream agents may invoke these features without realizing that local files, authenticated sessions, or downloaded content are crossing trust boundaries.
The trigger '截图' is extremely short and common, so it may activate this browser-control skill for unrelated screenshot requests. Since the skill exposes broader browser automation than simple image capture, an overly broad trigger can cause the system to select a more privileged tool than the user intended.
No suspicious patterns detected.
