Nova Act Browser Automation

• Analyzed: May 14, 2026, 3:40 AM
• Findings: 1
• Version: 1.6.0
• Hash: 7de592856668c265a28fd70244894f530dbe558fd35ef71402828c32c4db6e4b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the inherent risks associated with AI-powered browser automation and local data handling, despite robust safety guardrails. The skill explicitly states it writes 'Nova Act trace files in the current working directory (screenshots, session recordings)' which 'may capture PII or sensitive data visible on visited pages' (SKILL.md, README.md). While this risk is disclosed and the files are local, it represents a significant data exposure vulnerability. The `scripts/nova_act_runner.py` uses `subprocess.run` to execute a Python script with user-controlled `url` and `task` arguments, which, despite using `python-fire` for argument parsing, still presents a potential attack surface if underlying components have vulnerabilities. However, there is no evidence of intentional malicious behavior like data exfiltration to external endpoints, backdoors, or unauthorized remote control. The extensive safety instructions for the AI agent in SKILL.md and `references/nova-act-cookbook.md` are strong defenses against prompt injection and harmful actions, indicating an intent to operate safely rather than maliciously.