skill test

This skill appears to be a legitimate browser-automation CLI, but there are a few red flags and high-capability behaviors you should consider before installing or letting an agent use it autonomously: - Mismatched metadata: the description mentions Rust but the instructions show only Node/npm/pnpm; the SKILL.md references git and pnpm yet the skill's required-bins list omits them. Verify the real upstream project (inspect https://github.com/vercel-labs/agent-browser) before running install commands. - High privileges within web context: the CLI can read cookies/localStorage, take screenshots, record video, upload local files, and intercept/mock network requests. These are normal for browser automation but also let the tool access or exfiltrate sensitive session data if misused. - Installation risk: npm -g and building from source execute code on your machine. Only install from a trusted repository and review the package source (especially preinstall/build scripts) before running global installs. - Operational controls: avoid running this skill with sensitive accounts or files unless you sandbox it; do not provide secrets or local files unless necessary; prefer to run installs in a disposable environment (container/VM) and limit autonomous invocation if you are unsure. If you can, ask the publisher for a canonical homepage/release URL and verify the repository and package contents; if you plan to use it, validate the exact binary requirements (git, pnpm, node) and inspect build scripts before installing.