Token Efficient Web Operations en

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.1

Overview

This skill is a clearly disclosed browser UI automation/testing helper, but it should only be used with non-sensitive test pages and a reviewed browser extension.

Install only if you need browser UI automation testing. Use a separate browser profile with test accounts, review the external Chrome extension before loading it, and avoid private, financial, login, payment, medical, government, or business-sensitive pages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration

Content

1. **Extension Level**:
   - ✅ Page JS Extension runs entirely in browser locally
   - ✅ Does not proactively send data to external servers
   - ✅ Data stored in memory, cleared when page closes

2. **Agent Level**:

• Confidence: 82% confidence
• Finding: send data to external

VirusTotal

64/64 vendors flagged this skill as clean.