@agimon-ai/po-browse-tool@0.0.0-alpha.90
MCP server for browser automation using Playwright with profile management, page registry, and multi-browser support
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s default runtime telemetry setup passes a workspace root, potentially a local project path, to its telemetry library. The available source does not establish the telemetry destination or disclose the behavior, so this is a warning rather than a confirmed exfiltration finding.
Static reason
One or more suspicious static signals were detected.
Trigger
An application creates the browse runtime; telemetry initialization is not limited to an explicit telemetry call.
Impact
A local project path may be disclosed through runtime telemetry; the destination and transmitted payload could not be confirmed from the available source.
Mechanism
The runtime enables logging unless OTEL_SDK_DISABLED is set and passes workspaceRoot to the telemetry library. The inspected package source does not establish the resolved telemetry host.
AI rationale
The package’s default runtime telemetry setup passes a workspace root, potentially a local project path, to its telemetry library. The available source does not establish the telemetry destination or disclose the behavior, so this is a warning rather than a confirmed exfiltration finding.
Evidence
dist/index.cjsREADME.md
Network endpoints1
googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Creating a browse runtime constructs a telemetry client and passes it the workspace root.
- Runtime logs are enabled unless OTEL_SDK_DISABLED is set, and the default telemetry initialization forwards workspaceRoot to the telemetry library.
- The workspace root can be derived from BROWSE_TOOL_WORKSPACE_ROOT or the current working directory.
Evidence against
- The manifest has no install, preinstall, or postinstall hook.
- The package describes browser automation and exposes runtime creation as an API; browser process execution fits that purpose.
- The hard-coded external URL is Google's Chrome for Testing version feed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/index.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `)){let[t,r]=n.trim().split(/\s+/,2);if(!t||!r)continue;let i=Number(t),a=Number(r);if(Number.isNaN(i)||Number.isNaN(a))continue;let o=e.get(a);o?o.push(i):e.set(a,[i])}return e}as...
High
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `)){let[t,r]=n.trim().split(/\s+/,2);if(!t||!r)continue;let i=Number(t),a=Number(r);if(Number.isNaN(i)||Number.isNaN(a))continue;let o=e.get(a);o?o.push(i):e.set(a,[i])}return e}as...
L3: `);return await l.default.writeFile(m.default.join(n,`manifest.json`),JSON.stringify(r,null,2),{mode:384}),await l.default.writeFile(m.default.join(n,`background.js`),i,{mode:384})...
High
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `)){let[t,r]=n.trim().split(/\s+/,2);if(!t||!r)continue;let i=Number(t),a=Number(r);if(Number.isNaN(i)||Number.isNaN(a))continue;let o=e.get(a);o?o.push(i):e.set(a,[i])}return e}as...
Findings
6 High4 Medium5 Low
HighChild Processdist/index.cjs
HighShelldist/index.cjs
HighSame File Env Network Executiondist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
HighSandbox Evasion Gated Capabilitydist/index.cjs
HighTrigger Reachable Command Output Exfiltrationdist/index.cjs
MediumDynamic Requiredist/stubs/playwright-test.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/extension/background.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @agimon-ai/po-browse-tool@0.0.0-alpha.90.
See all versions of @agimon-ai/po-browse-tool for other recorded verdicts.
- Review the evidence and your use of @agimon-ai/po-browse-tool@0.0.0-alpha.90 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.