AI Browser

• Analyzed: Mar 24, 2026, 1:31 PM
• Findings: 1
• Version: 1.0.0
• Hash: d1b6e2e59e68137477fbaaef9f46c2234a4b9d8311a7b13da82b3fce4b81d50a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a WebSocket-based remote control interface for a Chromium browser using Puppeteer, which includes high-risk capabilities such as arbitrary JavaScript execution (`evaluate` action) and automated interaction (typing, clicking) without any authentication or authorization. The server (`server.js`) also disables the Chromium sandbox (`--no-sandbox`) and opens a remote debugging port (9222), creating a significant attack surface. While these features align with the stated goal of browser automation, the lack of security controls and the inclusion of a script (`quick-control.js`) specifically targeting a Chinese writing platform (fanqie.baidu.com) warrant a suspicious classification.