Auto Scraping to CSV

• Analyzed: May 12, 2026, 9:16 AM
• Findings: 1
• Version: 1.0.1
• Hash: 369442c299c3d24d2e620b30ca55f51440d67e2bb023a75d374e760c2ddf53fd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a bridge for browser automation using Playwright and Alibaba's Page-Agent, which includes the capability to execute arbitrary JavaScript in the browser context via the `executeJavascript` action in `page-agent-bridge.mjs`. While functional for scraping, the `SKILL.md` instructions explicitly direct the AI agent to solicit sensitive user credentials (usernames and passwords) for sites requiring login, posing a phishing risk. Additionally, the bridge dynamically fetches a script from a CDN (cdn.jsdelivr.net), introducing a supply chain dependency. Although these features align with the stated purpose of scraping complex sites, the combination of credential prompting and remote code execution in the browser warrants a suspicious classification.