Is skills/browser-automation-cdp safe?
https://clawhub.ai/skills/browser-automation-cdp
This is a legitimate browser automation skill that uses Chrome DevTools Protocol to control Edge/Chrome browsers. While it has inherent risks from browser control capabilities and JavaScript execution, the functionality is transparent and standard for automation tools.
Category Scores
Findings (5)
MEDIUM JavaScript execution in browser context -15 ▶
The skill's eval() method can execute arbitrary JavaScript in the user's browser, which could potentially be misused for malicious actions. However, this is standard functionality for browser automation tools.
MEDIUM Browser control capabilities -20 ▶
The skill can control user's browser through CDP, including navigation, clicking, screenshot capture, and JavaScript execution. While legitimate for automation, this could be misused if the skill were compromised.
LOW Potential web data access -10 ▶
Through browser automation, the skill could potentially access any data visible in the browser, including sensitive web applications. However, no evidence of actual data collection or exfiltration.
LOW Requires remote debugging setup -10 ▶
The skill requires users to enable browser remote debugging on ports 9222/9223, which increases the attack surface by exposing browser internals to network access.
INFO System monitoring detected file access -5 ▶
Canary files were accessed during the audit, but this appears to be system monitoring rather than the skill itself. All canary files remained intact.