QQBrowserSkill

• Analyzed: May 18, 2026, 8:51 AM
• Findings: 1
• Version: 0.8.0
• Hash: 4c3c97c85f01796125b9e322c10815e107768d638be5f9b6102cd5e4618c2bbe
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides extensive browser automation capabilities but includes high-risk features such as the `browser_eval_content_js` command, which explicitly supports base64-encoded scripts, facilitating the obfuscation of potentially malicious JavaScript. Additionally, the `install` command downloads and executes a binary from a remote Tencent CDN (dldir1v6.qq.com), introducing a supply chain risk. While these capabilities are aligned with the tool's stated purpose, the combination of binary installation and obfuscated execution paths represents a significant security risk in an agentic environment.