Security audit

Browser Fetch

Security checks across malware telemetry and agentic risk

Overview

This is a browser-based web fetching helper whose network, proxy, stealth, and optional file-output behavior is disclosed and aligned with its purpose.

Install this if you need browser-rendered fetching and are comfortable with Chromium automation, default stealth behavior, and ambient proxy use. Use --no-stealth for ordinary fetching, set FETCH_USE_ENV_PROXY=0 when you do not want inherited proxies, and avoid saving or sharing metadata when URLs or proxy strings may contain sensitive information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code supports writing page content to a user-specified path and separately writes metadata JSON to disk, but the file contains no confirmation prompt and no comment/docstring warning that local files will be created or overwritten. For a code-file audit, file-write behavior is safety-relevant when there is no visible disclosure in the implementation.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The code accesses environment variables such as CHROMIUM_PATH, FETCH_PROXY_SERVER, HTTPS_PROXY, and HTTP_PROXY to influence runtime behavior, but there is no visible warning that environment-derived configuration may be used. The audit criteria call for flagging sensitive environment-variable access when no disclosure is present.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.