Functions

• Analyzed: May 12, 2026, 3:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2f02cd29106d1926f51f954b46693ecedfb5b7e1ed24ae3f968bbb9fe5ed2dd5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its instructions for the AI agent to handle sensitive API keys and execute package manager commands. Specifically, `SKILL.md` instructs the agent to export and write `BROWSERBASE_API_KEY` and `BROWSERBASE_PROJECT_ID` to a `.env` file, implying access to these credentials. It also directs the agent to execute `pnpm dlx @browserbasehq/sdk-functions init` and `pnpm install`, which involve downloading and executing arbitrary code from external sources. While these actions are plausibly necessary for the stated purpose of deploying serverless browser automation, they represent high-risk capabilities that could be misused.