Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
3K
← All skills
Skill

browser-cdp

skill:agentscope-ai/qwenpaw#browser_cdp-en

Use this skill when the user explicitly wants to connect to a running Chrome browser, scan local CDP ports, specify a `cdp_port`, or share a single browser across multiple agents/tools. By default browser opens no debugging port; pass an explicit `cdp_port` only when the user wants another local tool to attach.

SkillsMP
Verdict
No issues found

Nothing found that works against the person who installs it.

Analyzed Oct 29, 2026, 18:38 UTC at 5d4f8fd

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
6,680
files scanned
14/14
checks satisfied
0
package advisories

Why this verdict

  • benign: 14 checks satisfied, nothing works against the installer of skill:src/qwenpaw/agents/tools/deprecated_browser/skills/browser_cdp-en (1 notes, 0 third-party flags)

Security findings 0

No security findings

Nothing found that works against the person who installs it.

Notes 1

Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.

Credential access

mediumNoteConfirmed on reviewmedium confidence

The skill tells the agent to attach to the user's existing Chrome, which exposes the user's logged-in sessions and open tabs to the agent; this is the declared connect-to-running-browser capability and is disclosed, so it is a note.

src/qwenpaw/agents/tools/deprecated_browser/skills/browser_cdp-en/SKILL.md:105
You need to attach to the user's existing login state or open tabs
vector:instruction
Reviewer's reasoning

Attaching to the user's running Chrome is the skill's declared core capability and is disclosed as a use case, so test 5 applies; the unit shows no hidden step, credential transfer to another host, or bypass of user consent.

Coverage gaps 7

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading-dark.mp4
context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading.mp4
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.icns
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.ico
context:oversize 12157200 bytes > max_file_bytes 8388608
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts
context:derived_output_exceeded 1 derived view(s) refused or truncated by the per-file output cap: hidden:json-string-leaf
src/qwenpaw/tokenizer/tokenizer.json
context:bytes_unavailable yara-x: no bytes to scan
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts