Browser Ladder

• Analyzed: May 12, 2026, 3:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 85d4b9772ac8b3b0c632cc9c77299973e5f156a676c99f51da19ec97d499c44c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill 'browser-ladder' is designed for hierarchical web browsing, utilizing `curl` for basic fetches, `docker` for local Playwright automation, and optional cloud services (BrowserCat, Browserless.io) via API keys. All high-risk capabilities, such as network access via `curl` and local execution via `docker run`, are explicitly declared in `SKILL.md` and transparently implemented in `scripts/browse.sh` for their stated purpose of web automation. The `scripts/setup.sh` script safely manages user-provided API keys in the local `.env` file. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.