Security audit
Security checks across malware telemetry and agentic risk
This skill appears to do what it says, but it gives an agent broad control over Chrome and runs a changing external MCP package with limited upfront safety scoping.
Install only if you intentionally want an agent to control Chrome. Use a separate or isolated browser profile, avoid sensitive accounts unless necessary, confirm any form submissions, uploads, or page-script execution, disable telemetry and CrUX where appropriate, and prefer a pinned vetted package version instead of @latest.
def run(cmd, capture=True, timeout=30):
try:
r = subprocess.run(cmd, shell=True, capture_output=capture, text=True, timeout=timeout)
return r.returncode, r.stdout.strip() if capture else "", r.stderr.strip() if capture else ""
except subprocess.TimeoutExpired:
return 1, "", "timeout"62/62 vendors flagged this skill as clean.
No suspicious patterns detected.