Features found in source
Most promised features found 81 / 100
App specification source review: 14.5 of 18 features (81%); partial features count half. Source review based on your App specification (18 features).
Orbit Internet Browser · Version 01a1c112-671e-7c40-b039-0cf6550fd678
Checked: 2026-11-09T16:10:31.333Z · Report generation 1
Status: complete · Analysis: live
Source check ✓ 2026-11-09T16:09:43.046Z
Most promised features found 81 / 100
App specification source review: 14.5 of 18 features (81%); partial features count half. Source review based on your App specification (18 features).
Good, small improvements suggested 82 / 100
3 security issue(s) found; serious issues reduce this score most. No scan guarantees safety.
Setup mostly documented 86 / 100
Present: README, environment example, known install command, run entry point, App specification or AGENTS. Missing: none. Static check in .; code was not executed. Checks README, environment example, install and run scripts, app specification or AGENTS, confirmed How to run it (confirmed) and run manifest (absent). The app was not executed.
Up to date 94 / 100
6 known issues, 5 have a fix (for example, npm audit fix); 0 production, 6 dev-only, 0 scope unknown. Licenses: 581 permissive, 0 copyleft, 13 unknown; 0 confirmed conflicts. Unknown licenses need review. Freshness and abandonment: not checked.
These files are too big for the AI review, so it skipped them. The rest of the report is complete. If a file matters to you, look at it yourself.
The AI read 39 of 211 source files.
App specification source review: 14.5 of 18 features found in source (81%)
Files checked: tab-manager.js, renderer.js, opencode-service.js
Tab create/switch/close and back navigation found in TabManager and renderer back handler.
Files from your spec: tab-manager.js, renderer.js, index.html
Evidence: tab-manager.js:1, renderer.js:1Files checked: automatic-sessions.js, workspace-store.js, renderer.js
Automatic session create/persist/rename/switch and last-opened restore found.
Files from your spec: automatic-sessions.js, workspace-panel.js, workspace-store.js
Evidence: automatic-sessions.js:1, workspace-store.js:1Files checked: tab-manager.js, opencode-service.js, automatic-sessions.js
Grouping, collapse-to-suspend, and vertical-tab drag logic found; vertical layout CSS not in sample.
Files from your spec: tab-manager.js, workspace-panel.js, styles.css
Evidence: tab-manager.jsFiles checked: tab-manager.js, scripts/linkedin-search.js, tab-crashed.html
Title/URL search over all tabs including suspended and collapsed found.
Files from your spec: tab-manager.js, workspace-panel.js, index.html
Evidence: tab-manager.jsFiles checked: opencode-service.js, browser-url-policy.js, renderer.js
OpenCode PTY service with model selection and browser MCP bridge found.
Files from your spec: opencode-service.js, terminal-panel.js, browser-tool-dispatcher.js
Evidence: opencode-service.jsFiles checked: session-files-panel.js, opencode-session-workspace.js, browser-task-lifecycle.js
Upload and list session files found; opencode-service.js not inspected.
Files from your spec: session-files-panel.js, opencode-session-workspace.js, opencode-service.js
Evidence: session-files-panel.js:1, opencode-session-workspace.js:1Files checked: browser-task-lifecycle.js, browser-tool-dispatcher.js, dynamic-artifact-prompt.js
Task tab tracking and cleanup preserving kept, artifact-source and non-owned tabs found.
Files from your spec: browser-task-lifecycle.js, browser-tool-dispatcher.js, scripts/browser-mcp-server.js
Evidence: browser-task-lifecycle.js:1, browser-tool-dispatcher.js:1Files checked: summarizer.js, openrouter-service.js, dynamic-artifact-prompt.js
Page text and YouTube transcript summarization paths found; main.js not inspected.
Files from your spec: summarizer.js, openrouter-service.js, main.js
Evidence: summarizer.js:1, openrouter-service.js:1Files checked: transformed-view-manager.js, transformed-view-service.js, dynamic-artifact-prompt.js
Cleaned extraction and saved refreshable transformed views found; main.js not inspected.
Files from your spec: transformed-view-manager.js, transformed-view-service.js, main.js
Evidence: transformed-view-manager.js:1, transformed-view-service.js:1Files checked: artifact-service.js, dynamic-artifact-prompt.js, openrouter-service.js
Text artifact create, preview, download and delete found; artifact-panel.js not inspected.
Files from your spec: artifact-service.js, artifact-panel.js, scripts/browser-mcp-server.js
Evidence: artifact-service.jsFiles checked: dynamic-artifact-service.js, dynamic-artifact-frame.js, artifact-service.js
Dynamic app save, settings, refresh scheduler, storage and sandboxed frame found.
Files from your spec: dynamic-artifact-service.js, dynamic-artifact-frame.js, artifact-service.js
Evidence: dynamic-artifact-service.js:1, dynamic-artifact-frame.js:1, artifact-service.js:1Files checked: bookmarks-panel.js, history-manager.js, scripts/linkedin-search.js
Bookmark save and AI bookmark-search IPC found; openrouter-service.js not in sample.
Files from your spec: bookmarks-panel.js, history-manager.js, openrouter-service.js
Evidence: bookmarks-panel.js:1, history-manager.js:1Files checked: renderer.js, scripts/job-search.js, scripts/linkedin-search.js
DuckDuckGo search and word! instant-search found; main.js handler not in sample.
Files from your spec: renderer.js, main.js
Evidence: renderer.js:1Files checked: renderer.js, dynamic-artifact-prompt.js, tab-crashed.js
Per-tab network toggle and activity bar found; main.js enforcement not in sample.
Files from your spec: main.js, renderer.js
Evidence: renderer.js:1Files checked: renderer.js, scripts/browser-mcp-server.js, scripts/browser-agent-harness.js
Global JS toggle and js-status reload found; main.js enforcement not in sample.
Files from your spec: main.js, renderer.js
Evidence: renderer.js:1Files checked: main.js, browser-remote-service.js, jest.setup.js
Cache and domain-blocking toggles found; renderer UI not in sample.
Files from your spec: main.js, renderer.js, block.list
Evidence: main.jsFiles checked: main.js, dlna-cast-manager.js, cast-panel.js
Download progress reporting found; clear-finished-downloads handler not found.
Files from your spec: main.js, renderer.js, index.html
Evidence: main.jsFiles checked: main.js, cast-panel.js, dlna-cast-manager.js
Device discovery, casting, subtitles and play/pause/seek controls found.
Files from your spec: cast-panel.js, dlna-cast-manager.js, cast-relay-service.js
Evidence: main.js:1, cast-panel.js:2, dlna-cast-manager.js:3Actual run verification: Not tested. Source review does not prove the app works. Dependency warnings permit publishing; harmful content and unresolved rights or license blockers prevent it. Checks do not guarantee safety.
Medium — could affect users in some situations; plan a fix.
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
Fix hint: Update glob from 13.0.6 to 14.0.2 or newer (check compatibility).
open · Dependency warning — does not block publishing · Scanner severity: medium
GHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4 · package-lock.jsonMedium — could affect users in some situations; plan a fix.
minimatch has potential denial of service via globparts amplification
Fix hint: Update minimatch from 9.0.9 to 11.0.1 or newer (check compatibility).
open · Dependency warning — does not block publishing · Scanner severity: medium
GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249 · package-lock.jsonMedium — could affect users in some situations; plan a fix.
deepmerge mergeObject() allows prototype poisoning of returned objects
Fix hint: Update deepmerge to a release that fixes this advisory; no fixed version was supplied by the scan.
open · Dependency warning — does not block publishing · Scanner severity: medium
GHSA-gcqx-w48m-w2h4 · package-lock.jsonMedium — could affect users in some situations; plan a fix.
A malicious page or AI-driven navigation could load a javascript: or data: URL into a webview, potentially executing script in a privileged context or exfiltrating data.
Fix hint: Validate the URL protocol before assigning it to a webview src (e.g., allow only http:, https:, about:blank, and the app's own browser:// schemes), and reject javascript:, data:, and file: URLs from untrusted sources.
open · Review finding
ai-security · tab-manager.jsMedium — could affect users in some situations; plan a fix.
Generated HTML artifacts run with inline script and can call the local artifact API, so a malicious artifact could read or modify other artifacts' data.
Fix hint: Restrict the artifact view CSP to a strict allowlist and avoid 'unsafe-inline' where possible; consider serving user HTML from a separate origin or sandboxed iframe with no access to the artifact API.
open · Review finding
ai-security · artifact-service.jsLow — limited impact; fix during routine maintenance.
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
Fix hint: Update diff from 7.0.0 to 8.0.3 or newer (check compatibility).
open · Dependency warning — does not block publishing · Scanner severity: low
GHSA-73rr-hh4g-fpgx · package-lock.jsonLow — limited impact; fix during routine maintenance.
If a crafted filename or id escapes the intended directory, an attacker could read or overwrite arbitrary files on the user's machine.
Fix hint: Add explicit validation that the resolved path stays within the intended directory (e.g., path.resolve and startsWith check) before reading or writing, and reject symlinks.
open · Review finding
ai-security · artifact-service.jsImprovement hints only; excluded from buyer headline scores.
Code cleanliness: 76 / 100 (AI maintainability review). Architecture: 76 / 100 (AI structure review). Test presence: 48 test files (presence signal only). Coverage: Not checked.
Source coverage: Sampled. Build not run by CookThisApp.