Chrome Control Proxy

• Analyzed: Apr 4, 2026, 11:21 AM
• Findings: 1
• Version: 1.0.2
• Hash: d1b233a06ce6af6c110c89c3305d59aece2df13a1927d59ff48c93b2d46d9802
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle describes a proxy service for browser automation that includes a high-risk endpoint, `/playwright/run`, which executes arbitrary JavaScript strings as asynchronous functions. While this functionality is aligned with the stated purpose of controlling Chrome via Playwright, the ability to execute unvalidated code on the host (via the Node.js service) poses a significant Remote Code Execution (RCE) risk. The `SKILL.md` file explicitly warns against exposing the service to untrusted parties, acknowledging the inherent security dangers of the tool's design.