Why this verdict
- inconclusive: gap request_unanswered
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below; 3 candidate findings were refuted on review.
Open questions 1
What the analysis could not settle from the code alone.
[invalid file request] Does this repository ship or pin the `agent-browser` CLI that SKILL.md invokes throughout (and permits via `Bash(npx agent-browser:*)`), or does `npx agent-browser` fetch an unpinned package from the npm registry at runtime?
Supply chain
Refuted findings 3
Candidates the review stage examined and rejected, kept for transparency.
Credential access
criticalRefutedlow confidenceThe skill directs the agent to harvest authentication headers (authorization, cookie, x-csrf-token, x-api-key) from the recorded HAR and replay them in the generated client, which is intrinsic to the declared reverse-engineering task but concentrates the user's session credentials for the target site; no exfiltration destination is shown.
Look for `authorization`, `cookie`, `x-csrf-token`, `x-api-key`, and site-specific `x-*` headers
Why it was refuted
Identifying auth headers in the user's own recorded session and replaying the ones that matter in the generated client is intrinsic to the declared core capability (reverse-engineer the API, generate a standalone client that calls endpoints directly) and is explicitly declared in D6/D7; no exfiltration destination exists anywhere in the artifact — the credentials flow only into the client the user asked for.
Credential access
criticalRefutedlow confidenceThe skill instructs the agent to export the browser's live session cookies to a local cookies.json file so the generated client can replay the authenticated session, placing session credentials on disk.
export the live session with `agent-browser cookies get --json > cookies.json`
Why it was refuted
The cookies.json export is declared verbatim in the skill body (D8), so the detector's undeclared-residue lead is contradicted by the cited unit itself, and writing the user's own live session cookies to a local file the generated client loads serves the declared no-browser standalone-client capability with a stated mitigation (never hardcode cookie values); no exfiltration destination is shown.
Supply chain
mediumRefutedlow confidenceThe skill's frontmatter grants a permission to run 'npx agent-browser', an undeclared runtime surface that fetches and executes the latest unpinned npm package beyond the local 'agent-browser' invocations the recorded-session workflow actually uses.
allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*)
Why it was refuted
The npx permission is openly declared in the artifact's own allowed-tools field — the standard permission-declaration surface for a skill — so it is neither undeclared nor concealed, and no unit in the skill body instructs the agent to run 'npx agent-browser' (every workflow command invokes plain 'agent-browser'), leaving a declared permission with no source→sink chain. The unpinned-npx concern remains a real but unexercised surface, which lowers severity rather than establishing a chain.
Coverage gaps 5
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
docs/src/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
examples/environments/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
packages/dashboard/src/app/favicon.ico
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
request_unanswered behavior-chains.0: invalid file request (bad path)
