Security checks across malware telemetry and agentic risk
This appears to be a legitimate browser automation skill, but it gives agents broad control over logged-in accounts and public posting without enough built-in scoping or confirmation.
Install only if you intentionally want an agent to operate a real logged-in browser profile. Use a separate low-sensitivity profile, keep port 9333 local, avoid untrusted eval strings, review every post/form/action before it runs, and consider pinning/auditing dependencies before use.
f"Where-Object {{ $_.CommandLine -like '*{profile.replace(chr(92), chr(92)+chr(92))}*' }} | "
"ForEach-Object { $_.ProcessId }"
)
out = subprocess.check_output(
["powershell", "-NoProfile", "-Command", ps_cmd],
text=True, timeout=15,
)import html2text # noqa
return html2text
except ImportError:
subprocess.check_call([sys.executable, "-m", "pip", "install", "-q", "html2text"])
import html2text # noqa
return html2textVirusTotal findings are pending for this skill version.