Why this verdict
- benign: 14 checks satisfied, nothing works against the installer of skill:src/qwenpaw/agents/tools/deprecated_browser/skills/browser_cdp-zh (1 notes, 0 third-party flags)
Security findings 0
No security findings
Nothing found that works against the person who installs it.
Notes 1
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceWhen the user explicitly asks for a fixed port, the skill starts Chrome with an explicit cdp_port, which exposes an unauthenticated debugging endpoint to any local process; the port check before bind also leaves a race window, so this is a note because the user invokes the step and decides.
用户明确要求固定端口 / 外部共享时，才显式传 `cdp_port`
vector:instruction
Reviewer's reasoning
The skill does start Chrome with an explicit cdp_port that exposes an unauthenticated debugging endpoint, but the doc states the port is passed only when the user explicitly asks for a fixed port or external sharing, and the unauthenticated endpoint harms the user only if another local process acts on it. That is user-invoked opt-in plus outside-actor dependence, so it stays a note.
Coverage gaps 7
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading-dark.mp4
context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading.mp4
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.icns
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.ico
context:oversize 12157200 bytes > max_file_bytes 8388608
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts
context:derived_output_exceeded 1 derived view(s) refused or truncated by the per-file output cap: hidden:json-string-leaf
src/qwenpaw/tokenizer/tokenizer.json
context:bytes_unavailable yara-x: no bytes to scan
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts
