github TypeScript analyzed 1d21564

sidebutton/sidebutton

Open-source browser automation for AI agents. MCP server + Chrome extension + YAML workflow engine + knowledge packs. Give your AI agent a browser and domain expertise.

maintainer: sidebutton
license: Apache-2.0
first seen: 2026-06-04
last seen: 2026-08-31
releases · 30d: 2
short id

Drift inferred · capture-to-capture

HIGH 2026-09-05 code analysis flagged hidden prompt content in sidebutton/sidebutton
HIGH 2026-06-22 code analysis flagged committed secret in sidebutton/sidebutton
HIGH 2026-06-10 code analysis flagged committed secret in sidebutton/sidebutton

tool count over time

06-10 17:52 08-11 16:22 now

2026-06-10 25t

2026-08-11 28t

2026-08-25 29t

capabilities 29 tools

transport stdio · http verified reported listed in the official MCP registry counts 29 tools · 0 res · 0 prompts permission surface via README inference

tools

browser_batch

Run a sequence of browser actions in one call
capture_page

Capture selectors from current page
clear_basic_auth

Clear stored HTTP Basic Auth credentials
click

Click an element
evaluate

Execute JavaScript in browser
exists

Check if element exists
extract

Extract text from element
extract_all

Extract all matching elements
extract_map

Extract structured data from repeated elements
fill

Fill input value (React-compatible)
get_browser_status

Check browser extension connection
get_run_log

Get execution log for a run
get_workflow

Get workflow YAML definition
hover

Hover over element
inject_css

Inject CSS into the page (blur/hide elements before a screenshot)
list_run_logs

List recent workflow executions
list_workflows

List all available workflows
navigate

Navigate browser to URL
press_key

Send keyboard keys
publish_artifact

Publish evidence (screenshots, reports) from a session
run_workflow

Execute a workflow by ID
screenshot

Capture page screenshot (pass path to write a PNG file instead of returning image bytes)
scroll

Scroll the page
scroll_into_view

Scroll element into viewport
select_option

Select dropdown option
set_basic_auth

Set HTTP Basic Auth credentials for the connected tab
snapshot

Get page accessibility snapshot
type

Type text into an element
wait

Wait for element or delay

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1d21564 · analyzer v33 · 9h ago

skills & prompt files 2

hidden: agent-rules: skill-exfil sidebutton-sidebutton-1d21564/packages/server/defaults/claude/CLAUDE.md :11 secret→sink: - Notion: send `Authorization: Bearer $NOTION_TOKEN` to `https://api.notion.com/v1` and pin `Notion-Version: 2026-03-11` on EVERY call — the header is required, and the version decides

agent-rules sidebutton-sidebutton-1d21564/AGENTS.md

danger signals1

suspicious endpoint 169.254.169.254 (cloud metadata) sidebutton-sidebutton-1d21564/packages/server/src/security.test.ts :98 'http://169.254.169.254/latest/meta-data/',

code evidence vv1.5.8 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 142

filesystem 45

fs (weak) sidebutton-sidebutton-1d21564/packages/core/src/claude-trust.test.ts :2 import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/core/src/claude-trust.ts :26 import { readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/core/src/contained-path.ts :17 import { chmodSync, lstatSync, mkdirSync, realpathSync, writeFileSync } from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/core/src/notion-browser-probe.test.ts :17 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/core/src/parser.ts :6 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/core/src/steps/browser.test.ts :11 import fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/core/src/steps/shell.ts :9 import { writeFileSync, chmodSync, existsSync } from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/scripts/mcp-stdio-probe.mjs :21 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/scripts/refresh-default-skills.mjs :16 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/agent-app-env.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/agent-app-env.ts :33 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/agent-claude-md.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/agent-claude-md.ts :26 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/claude-plugins-ledger.test.ts :4 import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/claude-plugins-ledger.ts :22 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/cli.ts :10 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/component-config.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/component-config.ts :24 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/context.ts :6 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/files.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/files.ts :13 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/basic-auth.test.ts :3 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/handler.test.ts :3 import fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/mcp/handler.ts :52 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/publish-artifact.test.ts :3 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/screenshot-path.test.ts :3 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/sse-transport.test.ts :4 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/stdio-transport.test.ts :2 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/plugins/executor.test.ts :2 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/plugins/loader.test.ts :2 import fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/plugins/loader.ts :5 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/plugins/service-manager.test.ts :2 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/projects.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/projects.ts :11 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/provider-usage-files.test.ts :11 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/registry.ts :9 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/server.ts :12 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/services/session-watcher.test.ts :2 import fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/services/session-watcher.ts :21 import fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/skill-pack.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/skill-pack.ts :5 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/skills.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/skills.ts :13 import * as fs from 'node:fs';
fs (weak) sidebutton-sidebutton-1d21564/packages/server/src/workspace-instructions.test.ts :2 import * as fs from 'node:fs';
fs sidebutton-sidebutton-1d21564/packages/server/src/workspace-instructions.ts :1 import * as fs from 'node:fs';

shell / exec 22

shell (weak) sidebutton-sidebutton-1d21564/packages/core/src/notion-browser-probe.test.ts :19 import { execFileSync } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/core/src/providers/github.ts :3 * Calls gh commands via child_process.execFile, parses JSON output,
shell (weak) sidebutton-sidebutton-1d21564/packages/core/src/providers/gitlab.test.ts :12 import { execFile } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/core/src/providers/gitlab.ts :3 * Twin of GhCliProvider (github.ts): calls glab via child_process.execFile, parses JSON output,
shell sidebutton-sidebutton-1d21564/packages/core/src/providers/jira-acli.ts :3 * Calls `acli jira workitem` commands via child_process.execFile.
shell sidebutton-sidebutton-1d21564/packages/core/src/providers/registry.ts :7 import { execFile } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/core/src/steps/shell.ts :6 import { exec, spawn } from 'node:child_process';
shell (weak) sidebutton-sidebutton-1d21564/packages/core/src/terminal-window-watch.test.ts :3 import type { ChildProcess } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/core/src/terminal-window-watch.ts :69 import { execFile } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/core/src/tracker-session-env.ts :39 import { spawnSync } from 'node:child_process';
shell (weak) sidebutton-sidebutton-1d21564/packages/server/scripts/mcp-browser-probe.mjs :19 import { spawn } from 'node:child_process';
shell (weak) sidebutton-sidebutton-1d21564/packages/server/scripts/mcp-stdio-probe.mjs :18 import { spawn } from 'node:child_process';
shell (weak) sidebutton-sidebutton-1d21564/packages/server/src/agent-app-env.test.ts :5 import { execFileSync } from 'node:child_process';
shell (weak) sidebutton-sidebutton-1d21564/packages/server/src/claude-probe.test.ts :2 import { execSync } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/server/src/cli.ts :1214 const { exec } = await import('node:child_process');
shell sidebutton-sidebutton-1d21564/packages/server/src/component-config.ts :27 import { execFile } from 'node:child_process';
shell (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/sse-transport.test.ts :2 import { execFileSync } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/server/src/plugins/executor.ts :6 import { spawn } from 'node:child_process';
shell (weak) sidebutton-sidebutton-1d21564/packages/server/src/projects.test.ts :5 import { execFile } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/server/src/projects.ts :9 import { execFile } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/server/src/registry.ts :11 import { execFile, execFileSync } from 'node:child_process';
shell sidebutton-sidebutton-1d21564/packages/server/src/server.ts :15 import { execSync, spawnSync } from 'node:child_process';

network 22

net (weak) sidebutton-sidebutton-1d21564/docs-site/docs/.vitepress/cache/deps/chunk-2CLQ7TTZ.js :5063 return fetch(
net (weak) sidebutton-sidebutton-1d21564/docs-site/docs/.vitepress/cache/deps/vitepress___@vue_devtools-api.js :3064 fetch(`${_baseUrl}__open-in-editor?file=${encodeURI(file)}`).then((response) => {
net (weak) sidebutton-sidebutton-1d21564/docs-site/docs/.vitepress/cache/deps/vitepress___minisearch.js :304 * re-assignment. In that case it is better to use `fetch()`, because it is
net (weak) sidebutton-sidebutton-1d21564/docs-site/docs/.vitepress/cache/deps_temp_36d1e2cb/chunk-2CLQ7TTZ.js :5063 return fetch(
net (weak) sidebutton-sidebutton-1d21564/docs-site/docs/.vitepress/cache/deps_temp_36d1e2cb/vitepress___@vue_devtools-api.js :3064 fetch(`${_baseUrl}__open-in-editor?file=${encodeURI(file)}`).then((response) => {
net (weak) sidebutton-sidebutton-1d21564/docs-site/docs/.vitepress/cache/deps_temp_36d1e2cb/vitepress___minisearch.js :304 * re-assignment. In that case it is better to use `fetch()`, because it is
net sidebutton-sidebutton-1d21564/packages/core/src/providers/jira.ts :33 const response = await fetch(url, {
net sidebutton-sidebutton-1d21564/packages/core/src/providers/linear.ts :80 const response = await fetch(LINEAR_GRAPHQL_URL, {
net sidebutton-sidebutton-1d21564/packages/core/src/steps/llm.ts :48 const response = await fetch(url, {
net sidebutton-sidebutton-1d21564/packages/core/src/terminal-window-watch.ts :242 const res = await fetch(url, { ...init, signal: AbortSignal.timeout(REPORT_TIMEOUT_MS) });
net sidebutton-sidebutton-1d21564/packages/dashboard/src/lib/api.ts :45 const response = await fetch(`${API_BASE}${url}`, fetchOptions);
net (weak) sidebutton-sidebutton-1d21564/packages/server/scripts/refresh-default-skills.mjs :56 const res = await fetch(`${BASE_URL}/api/skill-packs/${encodeURIComponent(domain)}/download`);
net sidebutton-sidebutton-1d21564/packages/server/src/cli.ts :216 const res = await fetch(`${REMOTE_BASE_URL}/api/skill-packs/${encodeURIComponent(domain)}/download`);
net sidebutton-sidebutton-1d21564/packages/server/src/mcp/handler.ts :1055 res = await fetch(uploadUrl, {
net (weak) sidebutton-sidebutton-1d21564/packages/server/src/mcp/sse-transport.test.ts :3 import http from 'node:http';
net (weak) sidebutton-sidebutton-1d21564/packages/server/src/preview-proxy.test.ts :2 import * as http from 'node:http';
net sidebutton-sidebutton-1d21564/packages/server/src/preview-proxy.ts :29 import * as http from 'node:http';
net sidebutton-sidebutton-1d21564/packages/server/src/registry.ts :426 const res = await fetch(`${REMOTE_REGISTRY_URL}/api/skill-packs`);
net sidebutton-sidebutton-1d21564/packages/server/src/security.ts :12 import * as net from 'node:net';
net sidebutton-sidebutton-1d21564/packages/server/src/server.ts :14 import * as net from 'node:net';
net sidebutton-sidebutton-1d21564/packages/server/src/services/report.ts :92 const res = await fetch(url, {
net sidebutton-sidebutton-1d21564/packages/server/src/services/session-watcher.ts :347 const res = await fetch(`${env.portalUrl}/api/agents/transcript-delta`, {

secrets 6

secrets sidebutton-sidebutton-1d21564/packages/core/src/steps/llm.ts :42 const apiKey = api_key || process.env.OPENAI_API_KEY;
secrets (weak) sidebutton-sidebutton-1d21564/packages/core/src/tracker-session-env.test.ts :25 process.env.SIDEBUTTON_AGENT_TOKEN = 'sb_test_token';
secrets sidebutton-sidebutton-1d21564/packages/core/src/tracker-session-env.ts :93 return process.env.SIDEBUTTON_AGENT_TOKEN || process.env.AGENT_TOKEN || '';
secrets (weak) sidebutton-sidebutton-1d21564/packages/dashboard/vite.config.ts :11 authToken: process.env.SENTRY_AUTH_TOKEN,
secrets sidebutton-sidebutton-1d21564/packages/server/src/mcp/handler.ts :1017 const token = process.env.AGENT_TOKEN || process.env.SIDEBUTTON_AGENT_TOKEN;
secrets sidebutton-sidebutton-1d21564/packages/server/src/server.ts :670 const agentToken = process.env.SIDEBUTTON_AGENT_TOKEN;

install hooks 2

prepublishOnly sidebutton-sidebutton-1d21564/packages/core/package.json :31 pnpm run build
prepublishOnly sidebutton-sidebutton-1d21564/packages/server/package.json :51 pnpm run build

declared dependencies 2

turbo@^2.3.0
typescript@^5.7.2