Browser Js

• Analyzed: May 12, 2026, 4:20 AM
• Findings: 1
• Version: 1.5.0
• Hash: a3e797fa97cafa4e7076b8e05a64c2a5fc660f473829b7f87d9cd6050867d0bf
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill bundle is classified as suspicious due to its powerful capabilities that, if misused via prompt injection against the AI agent, could lead to significant security risks. The `scripts/browser.js` file implements commands like `eval` which allows arbitrary JavaScript execution within the browser context, and `upload` which can read any local file (that the Node.js process has access to) and upload it to a web form. While these are intended features for a browser automation tool, they present a high-risk attack surface for data exfiltration or unauthorized actions if an AI agent is compromised. There is no evidence of intentional malicious code or prompt injection within the provided files themselves, but the inherent power of these commands warrants a 'suspicious' classification.