web-cap
Enables browser automation for inspecting and interacting with web pages through a command-line interface, enhancing data extraction and testing workflows.
Install this skill
Security score
The web-cap skill was audited on Jun 15, 2026 and we found 13 security issues across 3 threat categories, including 9 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 55 | - Save repeated or site-specific workflows under `${WEB_CAP_PATH}` as reusable capability scripts. |
Template literal with variable interpolation in command context
| 65 | - Look under `${WEB_CAP_PATH}/<domain>/` for scripts that match the target site or workflow. |
Template literal with variable interpolation in command context
| 66 | - Read `${WEB_CAP_PATH}/<domain>/README.md` when it exists before running a saved script. |
Template literal with variable interpolation in command context
| 70 | - Before writing any file under `${WEB_CAP_PATH}` or a reusable script domain directory, read `references/how-to-write-reusable-scripts.md`. |
Template literal with variable interpolation in command context
| 71 | - When saving a new reusable script, write it to `${WEB_CAP_PATH}/<domain>/<capability-name>.js`. |
Template literal with variable interpolation in command context
| 204 | | Reusable capability script | Agent-triggered browser workflow that can accept JSON input and return structured JSON output. | Run explicitly with `web-cap script-execute --script-file <path>`. | `${ |
Template literal with variable interpolation in command context
| 205 | | Page userscript | Page lifecycle script that should run automatically when matching pages load. | Installed with `web-cap userscript install --file <path>` and then injected by the extension. | Sour |
Template literal with variable interpolation in command context
| 207 | Only reusable capability scripts in `${WEB_CAP_PATH}` are meant to be run with |
Template literal with variable interpolation in command context
| 208 | `script-execute`. Do not put page userscripts under `${WEB_CAP_PATH}/<domain>/`, |
Prompting for password/secret input
| 120 | await page.locator('input[name="password"]').fill(input.password); |
External URL reference
| 226 | * @match https://example.com/* |
External URL reference
| 243 | example `https://example.com/*` or `*://*.example.com/docs/*`. |
External URL reference
| 254 | web-cap userscript list --match-url https://example.com/page |