@agimon-ai/po-browse-tool@0.0.0-alpha.86
MCP server for browser automation using Playwright with profile management, page registry, and multi-browser support
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source enables runtime telemetry by default and provides no README disclosure, but the telemetry implementation was unavailable, so its destination and payload cannot be established. This is a warning-level telemetry concern, not evidence of malicious exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
An application creates the browser runtime or default MCP logger.
Impact
Telemetry may disclose runtime or workspace details without a documented disclosure or opt-out.
Mechanism
The code calls @agimon-ai/po-logsink telemetry with traces and logs enabled unless OTEL_SDK_DISABLED is set.
AI rationale
The source enables runtime telemetry by default and provides no README disclosure, but the telemetry implementation was unavailable, so its destination and payload cannot be established. This is a warning-level telemetry concern, not evidence of malicious exfiltration.
Evidence
dist/index.cjs
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Creating the browser runtime initializes telemetry; unless OTEL_SDK_DISABLED is set, the telemetry provider is called with traces and logs enabled and receives the workspace root.
- The package does not document telemetry in its README, and the telemetry dependency implementation was unavailable to confirm its destination or collected fields.
Evidence against
- The package describes itself as a Playwright browser automation MCP server, consistent with its process, browser and network capabilities.
- The manifest has no install lifecycle scripts, and the entry point exports runtime factories rather than starting a server on import.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/index.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `)){let[t,r]=n.trim().split(/\s+/,2);if(!t||!r)continue;let i=Number(t),a=Number(r);if(Number.isNaN(i)||Number.isNaN(a))continue;let o=e.get(a);o?o.push(i):e.set(a,[i])}return e}as...
High
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `)){let[t,r]=n.trim().split(/\s+/,2);if(!t||!r)continue;let i=Number(t),a=Number(r);if(Number.isNaN(i)||Number.isNaN(a))continue;let o=e.get(a);o?o.push(i):e.set(a,[i])}return e}as...
L3: `);return await l.default.writeFile(m.default.join(n,`manifest.json`),JSON.stringify(r,null,2),{mode:384}),await l.default.writeFile(m.default.join(n,`background.js`),i,{mode:384})...
High
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `)){let[t,r]=n.trim().split(/\s+/,2);if(!t||!r)continue;let i=Number(t),a=Number(r);if(Number.isNaN(i)||Number.isNaN(a))continue;let o=e.get(a);o?o.push(i):e.set(a,[i])}return e}as...
Findings
6 High4 Medium5 Low
HighChild Processdist/index.cjs
HighShelldist/index.cjs
HighSame File Env Network Executiondist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
HighSandbox Evasion Gated Capabilitydist/index.cjs
HighTrigger Reachable Command Output Exfiltrationdist/index.cjs
MediumDynamic Requiredist/stubs/playwright-test.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/extension/background.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @agimon-ai/po-browse-tool@0.0.0-alpha.86.
See all versions of @agimon-ai/po-browse-tool for other recorded verdicts.
- Review the evidence and your use of @agimon-ai/po-browse-tool@0.0.0-alpha.86 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.