Security audit
Security checks for vulnerabilities and agentic risk
PinchTab is a coherent local browser automation skill, but users should treat it as powerful because it can control Chrome, read page content, and use persisted browser sessions.
Install only if you intend to let an agent control a Chrome browser. Use a fresh dedicated PinchTab profile, keep the API bound to 127.0.0.1, set BRIDGE_TOKEN before any network exposure, avoid daily or password-filled Chrome profiles, and treat screenshots, snapshots, raw text, and eval output as sensitive data.
如果怀疑安全事件： 1. 停止 PinchTab：`pkill pinchtab` 2. 删除配置文件：`rm -rf ~/.pinchtab/automation-profile` 3. 更改所有可能泄露的密码 4. 检查浏览器扩展和保存的密码
如果怀疑安全事件： 1. 停止 PinchTab：`pkill pinchtab` 2. 删除配置文件：`rm -rf ~/.pinchtab/automation-profile` 3. 更改所有可能泄露的密码 4. 检查浏览器扩展和保存的密码
}
```
### DELETE /tabs/{id}
关闭标签页。```bash # 删除配置文件 rm -rf ~/.pinchtab/work-profile ``` ## 最佳实践
```bash # 删除配置文件 rm -rf ~/.pinchtab/work-profile ``` ## 最佳实践
### 导航
```bash
curl -X POST http://localhost:9867/navigate \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}'
```导航后等待 3 秒再快照：
```bash
curl -X POST http://localhost:9867/navigate \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}' && \
sleep 3 && \No suspicious patterns detected.