Agent Browser

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 0.1.0
• Hash: 1f9a15283cbce32ab0eaa7cdb969b11bae05819cbfd3f51a178a6bc6eb372750
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides the `agent-browser` tool, which grants the AI agent extensive browser automation capabilities as documented in `SKILL.md`. These capabilities include arbitrary JavaScript execution (`agent-browser eval`), local file access (`agent-browser open file://`, `agent-browser upload`), network request interception and modification (`agent-browser network route`), and the ability to load custom browser executables or extensions (`--executable-path`, `--extension`). While the provided documentation and templates are benign, the broad `allowed-tools: Bash(agent-browser:*)` permission in `SKILL.md` combined with these powerful features presents a significant risk for potential misuse, such as data exfiltration or unauthorized execution, if the agent were to receive a malicious prompt.