Caveat verdict

browser-secure

88
🟢 Trusted
No high-risk patterns surfaced by the deep scan — automated capability review, not behavioral proof.

Secure browser automation with vault-backed credentials (Bitwarden/1Password), approval gates, and audit logging; auto-vault discovery reads credentials from the user's local password manager for use on their own accounts.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

0
security
50
transparency
80
maintenance

Permission integrity

Code accesses API keys/tokens but declares no environment variables

credential_access

Installs packages at runtime — transitive dependencies are not auditable

package_install

Findings (12)

Pattern match high

Accesses system credential store

README.md · code · keychain

Pattern match high

Uses eval() — can execute arbitrary code

src/browser/secure-session.ts · prose · downgraded · eval(

Pattern match high

Possible hardcoded credential

src/vault/discovery.ts · prose · downgraded · Password:', e); return []; } }

Pattern match medium

Instructs covert action — may act without user awareness

SKILL.md · prose · downgraded · silently

Pattern match medium

Enumerates all environment variables

dist/config/loader.js · prose · downgraded · Object.keys(process.env)

Pattern match medium

References child_process — can spawn system processes

scripts/onboarding.js · prose · downgraded · child_process

Pattern match medium

Downloads executables from external URLs

scripts/onboarding.js · prose · downgraded · Install from https://

Pattern match medium

Uses spawn() — can execute external programs

src/browser/daemon.ts · prose · downgraded · spawn(

Pattern match medium

Dynamic import() — loads module at runtime

src/cli.ts · prose · downgraded · import('

Pattern match low

References webhook/callback URL

dist/config/loader.d.ts · prose · downgraded · WebhookUrl

Pattern match low

Accesses sensitive environment variables

dist/security/credential-cache.js · prose · downgraded · process.env.BROWSER_SECURE_CACHE_KEY

Pattern match low

Opens WebSocket connection

src/browser/daemon.ts · prose · downgraded · WebSocket

Why the tier is capped

Execution sink present in raw bytes (Hard Floor: class B/D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.

Permissions & capabilities

No declared permissions — minimal attack surface.

credential_accesspackage_installdynamic_eval

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API