DLBrowser

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files. requests shell access. No manifest field names shell or command execution.

  PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES

  build_dlbrowser.py, line 17

  shutil.rmtree(SRC)

  hermes-agent-browser/browser_tool.py, line 912

  proc = subprocess.Popen(

  hermes-agent-browser/browser_tool.py, line 1372

  shutil.rmtree(socket_dir, ignore_errors=True)

  Show more

  hermes-agent-browser/browser_tool.py, line 1378

  shutil.rmtree(socket_dir, ignore_errors=True)

  hermes-agent-browser/browser_tool.py, line 1385

  shutil.rmtree(socket_dir, ignore_errors=True)

  hermes-agent-browser/browser_tool.py, line 1401

  shutil.rmtree(socket_dir, ignore_errors=True)

  hermes-agent-browser/browser_tool.py, line 2073

  proc = subprocess.Popen(

  hermes-agent-browser/browser_tool.py, line 3504

  shutil.rmtree(socket_dir, ignore_errors=True)

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  requirements.txt, line 2

  beautifulsoup4>=4.12

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  build_dlbrowser.py, line 788

  result = await fetch(current_url, mode="article", stealth=True, timeout=15)

  build_dlbrowser.py, line 1203

  result = await fetch(json_url, mode="text", stealth=True, timeout=15)

  build_dlbrowser.py, line 1227

  result = await fetch(url, mode="article", stealth=True, timeout=15)

  Show more

  build_dlbrowser.py, line 1261

  result = await fetch(url, mode="article", stealth=True, timeout=15)

  build_dlbrowser.py, line 1280

  result = await fetch(api_url, mode="text", stealth=True, timeout=15)

  build_dlbrowser.py, line 1298

  result = await fetch(url, mode="article", stealth=True, timeout=15)

  build_dlbrowser.py, line 1321

  result = await fetch(url, mode="article", stealth=True, timeout=15)

  build_dlbrowser.py, line 1341

  result = await fetch(api_url, mode="text", stealth=True, timeout=10)

  src/cli.py, line 44

  # fetch (one-shot)

  src/cli.py, line 90

  result = await fetch(args.url, mode=args.mode, stealth=args.stealth, timeout=args.timeout)

  src/hermes_browser/discovery.py, line 90

  result = await fetch(current_url, mode="article", stealth=True, timeout=15)

  src/hermes_browser/production.py, line 357

  result = await fetch(task.url, mode="article", stealth=True, timeout=task.timeout)

  src/hermes_browser/production.py, line 371

  result = await fetch(task.url, mode="article", stealth=True, timeout=task.timeout)

  src/hermes_browser/production.py, line 386

  result = await fetch(task.url, mode="article", stealth=True, timeout=task.timeout)

  src/hermes_browser/webhooks.py, line 263

  resp = urllib.request.urlopen(req, timeout=self.timeout)

  src/hermes_browser/outcomes/competitor_monitor.py, line 99

  result = await fetch(url, mode="article", stealth=True)

  CHANGES.md, line 99

  result = await fetch('https://example.com', proxy=proxy.get_proxy())

  docker-compose.yml, line 33

  test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8929/health')"]

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  connect/bin/dlbrowser.js, line 108

  const out = { hosts: [], key: process.env.DLBROWSER_API_KEY || '', url: DEFAULT_URL, stdio: false, print: false };

  hermes-agent-browser/browser_camofox.py, line 20

  Then set ``CAMOFOX_URL=http://localhost:9377`` in ``~/.hermes/.env``.

  hermes-agent-browser/browser_camofox.py, line 139

  os.getenv("CAMOFOX_SESSION_KEY", "").strip()

  Show more

  skills/stealth-scraping/references/tavily-source-discovery.md, line 10

  TAVILY_API_KEY = os.getenv("TAVILY_API_KEY", "")

  src/hermes_browser/captcha.py, line 26

  self.api_key = api_key or os.environ.get("CAPTCHA_API_KEY")

  src/hermes_browser/dotenv.py, line 1

  """Minimal .env loader (no dependency).

  src/hermes_browser/dotenv.py, line 3

  Loads ``.env.local`` then ``.env`` from the current directory (and the project

  src/hermes_browser/dotenv.py, line 31

  """Load .env.local / .env from CWD and the package's project root."""

  src/hermes_browser/dotenv.py, line 35

  for name in (".env.local", ".env"):

  src/hermes_browser/engine.py, line 127

  if (not forced or forced == "firecrawl") and os.environ.get("FIRECRAWL_API_KEY"):

  src/hermes_browser/hermes_ds_fallback.py, line 42

  api_key = api_key or os.environ.get("FIRECRAWL_API_KEY", "")

  src/hermes_browser/hermes_ds_fallback.py, line 126

  api_key = api_key or os.environ.get("FIRECRAWL_API_KEY", "")

  src/hermes_browser/llm_manager.py, line 179

  self.add_key(provider, key=os.environ.get("FREE_LLM_KEY", "free"),

  .gitignore, line 1

  # Secrets - NEVER commit

  .gitignore, line 2

  .env

  .gitignore, line 3

  .env.local

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 60ebfa3aab9c. can delete files. requests shell access. No manifest field names shell or command execution. dependencies are not pinned. accepts a host from input, with no fixed list in this file. reads a credential or environment file.

Date and source

Date checked: 18 Oct 2026

Read how this letter is chosen