Scanned skills

zenstory-ai/oh-story-claudecode browser-cdp

Checked the catalogued skill at browser-cdp.

SkillTrust corpus scan 19 September 2026 v0.10.0 via skillsh Verify on GitHub
F AI-triaged 9
GitHub
F Security

F; retained sample includes a critical finding · SD-013 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

A Transparency

A set by no findings on this axis

9 findings
permission_hygienehigh SD-003
scripts/setup-cdp-chrome.js
permission_hygienehigh SD-003
scripts/setup-cdp-chrome.js
permission_hygienehigh SD-003
scripts/setup-cdp-chrome.js
securityhigh SD-007
scripts/setup-cdp-chrome.js
securityhigh SD-007
scripts/setup-cdp-chrome.js
securitycritical SD-013
scripts/setup-cdp-chrome.js
securitycritical SD-013
scripts/setup-cdp-chrome.js
securityhigh SD-007
scripts/setup-cdp-chrome.js
securitycritical SD-013
scripts/setup-cdp-chrome.js
1 suppressed by AI triage
securitycritical SD-001 benign_example
SKILL.md

The snippet shows a static, documented example of using eval with a base64‑encoded string, not an unsanitized variable that could be injected by an attacker.