agent-browser

A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co...

This SKILL.md appears to be a straightforward wrapper for an external CLI, but the package will be fetched from the network if you follow the installation steps. Before installing or running this skill: (1) verify the npm package and GitHub repository are legitimate (confirm publisher, repo owner, release tags, and checksums); (2) prefer installing and reviewing the package manually in a sandbox or VM rather than allowing automated installation; (3) avoid running global npm installs as an unprivileged user without inspection of package install scripts; (4) if you need stronger assurance, request a homepage/repository URL from the publisher and review the upstream code (especially build/install scripts) or use well-known alternatives (Playwright/Puppeteer) with a verifiable origin. The lack of a declared source/homepage and the owner-identifier mismatch are the primary reasons for caution.

Type: OpenClaw Skill Name: peng-agent-browser Version: 0.2.0 The skill provides a wrapper for the 'agent-browser' CLI, which includes high-risk capabilities such as arbitrary JavaScript execution (eval), session cookie extraction, and session state saving/loading. While these features are aligned with the stated purpose of browser automation and testing, they represent a significant attack surface for session hijacking and data exfiltration if the agent is manipulated. The documentation in SKILL.md also includes instructions for global npm installations and source builds from external GitHub repositories (vercel-labs/agent-browser).