Why this verdict
- benign: 62 checks satisfied, no findings for skill:skill-data/electron
Security findings 0
No security findings
No suspicious or malicious behavior was found; 2 candidate findings were refuted on review.
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Credential access
highRefutedlow confidenceThe supported-apps list extends the declared automation capability to credential managers and secure messengers (1Password, Signal, Telegram Desktop), which CDP automation could expose stored secrets from if the agent is directed to control them.
- **Productivity:** Todoist, Linear, 1Password
Why it was refuted
The supported-apps list is documentation of the declared generic capability of automating any Electron desktop app; it contains no instruction to open a credential manager or extract stored secrets, so the behavior falls under the declared core capability and no source-to-sink chain to credential exposure exists.
Supply chain
mediumRefutedlow confidenceThe skill's frontmatter grants the agent unpinned `npx agent-browser` execution, so the npm registry supplies whatever latest version of the automation tool exists at runtime rather than a pinned, reviewed one.
allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*)
Why it was refuted
The npx grant is openly declared in the frontmatter and is the documented mechanism for the declared core capability of automating Electron apps with agent-browser, so nothing is undeclared, concealed, or contradicted; it is a scoped permission grant, and no shown unit instructs `npx agent-browser` execution (body commands invoke bare `agent-browser`), so no concrete chain exists.
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
docs/src/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
examples/environments/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
packages/dashboard/src/app/favicon.ico
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
