registry / @agimon-ai/browse-tool / 0.18.2

@agimon-ai/browse-tool@0.18.2

MCP server for browser automation using Playwright with profile management, page registry, and multi-browser support

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 1.03 MB of source, external domains: github.com, googlechromelabs.github.io, host.docker.internal, json-schema.org, proxy.example.com

Source & flagged code

3 flagged

dist/extension/background.jsView file

Lines 281-321javascript

281 });

282}

283function mergeDefs(...defs) {

284 const mergedDescriptors = {};

285 for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));

286 return Object.defineProperties({}, mergedDescriptors);

287}

288function esc(str) {

289 return JSON.stringify(str);

290}

291function slugify(input) {

292 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");

293}

294var captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

295function isObject(data) {

296 return typeof data === "object" && data !== null && !Array.isArray(data);

297}

298var allowsEval = /* @__PURE__ */ cached(() => {

299 if (globalConfig.jitless) return false;

300 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

301 try {

302 new Function("");

303 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/extension/background.jsView on unpkg · L301

304 } catch (_) {

305 return false;

306 }

307});

308function isPlainObject(o) {

309 if (isObject(o) === false) return false;

310 const ctor = o.constructor;

311 if (ctor === void 0) return true;

312 if (typeof ctor !== "function") return true;

313 const prot = ctor.prototype;

314 if (isObject(prot) === false) return false;

315 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

316 return true;

317}

318function shallowClone(o) {

319 if (isPlainObject(o)) return { ...o };

320 if (Array.isArray(o)) return [...o];

321 if (o instanceof Map) return new Map(o);

dist/streamable-http-NsAxqBXj.cjsView file

Lines 1-21javascript

Source & flagged code

3 flagged · loading source

dist/extension/background.jsView file

301try { L302: new Function(""); L303: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/extension/background.jsView on unpkg · L301

dist/streamable-http-NsAxqBXj.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/streamable-http-NsAxqBXj.cjsView on unpkg · L1

1var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{i... L2: `)){let[t,r]=n.trim().split(/\s+/,2);if(!t||!r)continue;let i=Number(t),a=Number(r);if(Number.isNaN(i)||Number.isNaN(a))continue;let o=e.get(a);o?o.push(i):e.set(a,[i])}return e}fu... L3: `).filter(Boolean).map(Number).filter(e=>!Number.isNaN(e))}catch{n=xe().get(e)??[]}for(let e of n)t.push(...Se(e)),t.push(e)}catch{}return t}function Ce(e){try{return process.kill(... L4: `);return p.default.writeFileSync(f.default.join(n,`manifest.json`),JSON.stringify(r,null,2)),p.default.writeFileSync(f.default.join(n,`background.js`),i),n}function gt(e){let t=[`...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/streamable-http-NsAxqBXj.cjsView on unpkg · L1

Findings

2 High2 Medium5 Low

HighSame File Env Network Executiondist/streamable-http-NsAxqBXj.cjs

HighCommand Output Exfiltrationdist/streamable-http-NsAxqBXj.cjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/extension/background.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/extension/background.jsView file

Lines 281-321javascript

281 });

282}

283function mergeDefs(...defs) {

284 const mergedDescriptors = {};

285 for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));

286 return Object.defineProperties({}, mergedDescriptors);

287}

288function esc(str) {

289 return JSON.stringify(str);

290}

291function slugify(input) {

292 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");

293}

294var captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

295function isObject(data) {

296 return typeof data === "object" && data !== null && !Array.isArray(data);

297}

298var allowsEval = /* @__PURE__ */ cached(() => {

299 if (globalConfig.jitless) return false;

300 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

301 try {

302 new Function("");

303 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/extension/background.jsView on unpkg · L301

304 } catch (_) {

305 return false;

306 }

307});

308function isPlainObject(o) {

309 if (isObject(o) === false) return false;

310 const ctor = o.constructor;

311 if (ctor === void 0) return true;

312 if (typeof ctor !== "function") return true;

313 const prot = ctor.prototype;

314 if (isObject(prot) === false) return false;

315 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

316 return true;

317}

318function shallowClone(o) {

319 if (isPlainObject(o)) return { ...o };

320 if (Array.isArray(o)) return [...o];

321 if (o instanceof Map) return new Map(o);

dist/streamable-http-NsAxqBXj.cjsView file

Lines 1-21javascript