browser-tools
What this skill does
Interactive browser automation via Chrome DevTools Protocol for tasks like web page interaction, frontend testing, and user-assisted browser operations.
github/badlogic - Path Traversal - 2.4k stars
Threat analysis
Skill info
pkg:github/badlogic/pi-skills@90bb51c?skill=browser-toolsAssessments (3)
Path Traversal
Path Traversal via local-llm-review
browser-start.js
The use of `${process.env.HOME}/.cache/browser-tools` and `${process.env.HOME}/Library/Application Support/Google/Chrome/` could be vulnerable to path traversal attacks if `process.env.HOME` is manipuCommand Injection
Command Injection via local-llm-review
browser-start.js
The use of `execSync` with user-provided input (e.g., `process.argv[2]`) could be vulnerable to command injection if not properly sanitized.Insecure File Operations
Insecure File Operations via local-llm-review
browser-start.js
The script uses `execSync` to remove files (`rm -f`) without checking for potential unintended file deletions.Badge
Add the Anomity scan badge for browser-tools to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of browser-tools? Report an issue or request a rescan.
