Why this verdict
- benign: 7 checks satisfied, nothing works against the installer of skill:src/qwenpaw/agents/skills/browser-zh (1 notes, 0 third-party flags)
Security findings 0
No security findings
Nothing found that works against the person who installs it.
Notes 1
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
mediumNoteConfirmed on reviewlow confidenceThe browser skill's chrome backend runs inside the user's real browser profile, so the agent's page actions use the user's cookies, logins, and storage; this is the declared core capability and the skill discloses it, so it is a note for the installer.
identity (cookies, logins, storage) is shared with the user's
vector:instruction
Reviewer's reasoning
The chrome backend operating in the user's real profile is the skill's declared core capability, and the skill discloses that cookies and logins are shared, so it is a note under the declared-core carve-out. Nothing in the quoted text sends credentials to another host or bypasses consent, so it does not reach overreach.
Coverage gaps 7
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading-dark.mp4
context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading.mp4
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.icns
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.ico
context:oversize 12157200 bytes > max_file_bytes 8388608
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts
context:derived_output_exceeded 1 derived view(s) refused or truncated by the per-file output cap: hidden:json-string-leaf
src/qwenpaw/tokenizer/tokenizer.json
context:bytes_unavailable yara-x: no bytes to scan
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts
