CookThisApp

Kitchen Report

Home · Add an app

Not reviewed by AI (1)

These files are too big for the AI review, so it skipped them. The rest of the report is complete. If a file matters to you, look at it yourself.

  • block.list: not reviewed, used by README.md and 5 more

Scores

Score details and supporting evidence for each check.

81 / 100

Most promised features found

Features found in source

App specification source review: 14.5 of 18 features (81%); partial features count half. Source review based on your App specification (18 features).

The AI read 39 of 211 source files.

Features found in the code

App specification source review: 14.5 of 18 features found in source (80.56%)

Show the 18 features
  • ◐ Organize tabs into named groups, collapse groups to unload their pages, and choose horizontal or resizable vertical tabs. — partly

    Files checked: tab-manager.js, opencode-service.js, automatic-sessions.js

    Grouping, collapse-to-suspend, and vertical-tab drag logic found; vertical layout CSS not in sample.

    Evidence: tab-manager.js

    Files from your spec: tab-manager.js, workspace-panel.js, styles.css

  • ◐ Save bookmarks and find saved pages using AI-assisted natural-language search. — partly

    Files checked: bookmarks-panel.js, history-manager.js, scripts/linkedin-search.js

    Bookmark save and AI bookmark-search IPC found; openrouter-service.js not in sample.

    Evidence: bookmarks-panel.js:1, history-manager.js:1

    Files from your spec: bookmarks-panel.js, history-manager.js, openrouter-service.js

  • ◐ Search the web through DuckDuckGo from the address bar and use instant-search shortcuts. — partly

    Files checked: renderer.js, scripts/job-search.js, scripts/linkedin-search.js

    DuckDuckGo search and word! instant-search found; main.js handler not in sample.

    Evidence: renderer.js:1

    Files from your spec: renderer.js, main.js

  • ◐ Enable or disable network access independently for each tab and view network activity. — partly

    Files checked: renderer.js, dynamic-artifact-prompt.js, tab-crashed.js

    Per-tab network toggle and activity bar found; main.js enforcement not in sample.

    Evidence: renderer.js:1

    Files from your spec: main.js, renderer.js

  • ◐ Enable or disable JavaScript across browser tabs. — partly

    Files checked: renderer.js, scripts/browser-mcp-server.js, scripts/browser-agent-harness.js

    Global JS toggle and js-status reload found; main.js enforcement not in sample.

    Evidence: renderer.js:1

    Files from your spec: main.js, renderer.js

  • ◐ Toggle browser caching and domain blocking. — partly

    Files checked: main.js, browser-remote-service.js, jest.setup.js

    Cache and domain-blocking toggles found; renderer UI not in sample.

    Evidence: main.js

    Files from your spec: main.js, renderer.js, block.list

  • ◐ View download progress and clear finished downloads from the download status display. — partly

    Files checked: main.js, dlna-cast-manager.js, cast-panel.js

    Download progress reporting found; clear-finished-downloads handler not found.

    Evidence: main.js

    Files from your spec: main.js, renderer.js, index.html

  • ✓ Browse websites in multiple tabs, switch between them, close tabs, and navigate backward through page history. — found

    Files checked: tab-manager.js, renderer.js, opencode-service.js

    Tab create/switch/close and back navigation found in TabManager and renderer back handler.

    Evidence: tab-manager.js:1, renderer.js:1

    Files from your spec: tab-manager.js, renderer.js, index.html

  • ✓ Automatically create named sessions, save browsing changes, rename or switch sessions, and restore the last-used session at startup. — found

    Files checked: automatic-sessions.js, workspace-store.js, renderer.js

    Automatic session create/persist/rename/switch and last-opened restore found.

    Evidence: automatic-sessions.js:1, workspace-store.js:1

    Files from your spec: automatic-sessions.js, workspace-panel.js, workspace-store.js

  • ✓ Search tab titles and website addresses, including unloaded tabs and tabs inside collapsed groups. — found

    Files checked: tab-manager.js, scripts/linkedin-search.js, tab-crashed.html

    Title/URL search over all tabs including suspended and collapsed found.

    Evidence: tab-manager.js

    Files from your spec: tab-manager.js, workspace-panel.js, index.html

  • ✓ Use an integrated OpenCode terminal to research and interact with real browser pages using a selected AI model. — found

    Files checked: opencode-service.js, browser-url-policy.js, renderer.js

    OpenCode PTY service with model selection and browser MCP bridge found.

    Evidence: opencode-service.js

    Files from your spec: opencode-service.js, terminal-panel.js, browser-tool-dispatcher.js

  • ✓ Upload supporting files for an OpenCode task and view the files available to that session. — found

    Files checked: session-files-panel.js, opencode-session-workspace.js, browser-task-lifecycle.js

    Upload and list session files found; opencode-service.js not inspected.

    Evidence: session-files-panel.js:1, opencode-session-workspace.js:1

    Files from your spec: session-files-panel.js, opencode-session-workspace.js, opencode-service.js

  • ✓ Complete an AI task by cleaning up its tracked temporary research tabs while preserving existing tabs, retained results, and live-artifact sources. — found

    Files checked: browser-task-lifecycle.js, browser-tool-dispatcher.js, dynamic-artifact-prompt.js

    Task tab tracking and cleanup preserving kept, artifact-source and non-owned tabs found.

    Evidence: browser-task-lifecycle.js:1, browser-tool-dispatcher.js:1

    Files from your spec: browser-task-lifecycle.js, browser-tool-dispatcher.js, scripts/browser-mcp-server.js

  • ✓ Generate summaries of webpage content and available YouTube transcripts. — found

    Files checked: summarizer.js, openrouter-service.js, dynamic-artifact-prompt.js

    Page text and YouTube transcript summarization paths found; main.js not inspected.

    Evidence: summarizer.js:1, openrouter-service.js:1

    Files from your spec: summarizer.js, openrouter-service.js, main.js

  • ✓ Clean up page content for reading and create saved, refreshable transformed views of source pages. — found

    Files checked: transformed-view-manager.js, transformed-view-service.js, dynamic-artifact-prompt.js

    Cleaned extraction and saved refreshable transformed views found; main.js not inspected.

    Evidence: transformed-view-manager.js:1, transformed-view-service.js:1

    Files from your spec: transformed-view-manager.js, transformed-view-service.js, main.js

  • ✓ Create, preview, download, and delete generated text-based artifacts, including HTML reports, CSV, JSON, and Markdown. — found

    Files checked: artifact-service.js, dynamic-artifact-prompt.js, openrouter-service.js

    Text artifact create, preview, download and delete found; artifact-panel.js not inspected.

    Evidence: artifact-service.js

    Files from your spec: artifact-service.js, artifact-panel.js, scripts/browser-mcp-server.js

  • ✓ Create interactive dashboards with saved preferences, source data, and configurable refresh behavior. — found

    Files checked: dynamic-artifact-service.js, dynamic-artifact-frame.js, artifact-service.js

    Dynamic app save, settings, refresh scheduler, storage and sandboxed frame found.

    Evidence: dynamic-artifact-service.js:1, dynamic-artifact-frame.js:1, artifact-service.js:1

    Files from your spec: dynamic-artifact-service.js, dynamic-artifact-frame.js, artifact-service.js

  • ✓ Discover compatible TVs and cast supported web videos with subtitle options and available playback controls. — found

    Files checked: main.js, cast-panel.js, dlna-cast-manager.js

    Device discovery, casting, subtitles and play/pause/seek controls found.

    Evidence: main.js:1, cast-panel.js:2, dlna-cast-manager.js:3

    Files from your spec: cast-panel.js, dlna-cast-manager.js, cast-relay-service.js

Static AI review of the source. Partial features count half. Actual run verification: Not tested; source presence and a responding demo do not prove the features work.

82 / 100

Good, small improvements suggested

Security screening

3 security issue(s) found; serious issues reduce this score most. No scan guarantees safety.

  • medium · Webview src set from unvalidated URL · tab-manager.js

    What to do: Validate the URL protocol before assigning it to a webview src (e.g., allow only http:, https:, about:blank, and the app's own browser:// schemes), and reject javascript:, data:, and file: URLs from untrusted sources.

  • medium · Artifact HTML served with inline script and same-origin API access · artifact-service.js

    What to do: Restrict the artifact view CSP to a strict allowlist and avoid 'unsafe-inline' where possible; consider serving user HTML from a separate origin or sandboxed iframe with no access to the artifact API.

  • low · Path handling for artifact files relies on basename and UUID checks · artifact-service.js

    What to do: Add explicit validation that the resolved path stays within the intended directory (e.g., path.resolve and startsWith check) before reading or writing, and reject symlinks.

86 / 100

Setup mostly documented

Setup files

Present: README, environment example, known install command, run entry point, App specification or AGENTS. Missing: none. Static check in .; code was not executed. Checks README, environment example, install and run scripts, app specification or AGENTS, confirmed How to run it (confirmed) and run manifest (absent). The app was not executed.

  • ✓ README — README.md
  • ✓ Environment example — .env.example
  • ✓ Install command
  • ✓ Run entry point
  • ✓ App specification or AGENTS — Saved App specification
  • ✓ Confirmed How to run it
  • ✕ Run manifest

94 / 100

Up to date

Dependency & license health

6 known issues, 5 have a fix (for example, npm audit fix); 0 production, 6 dev-only, 0 scope unknown. Licenses: 581 permissive, 0 copyleft, 13 unknown; 0 confirmed conflicts. Unknown licenses need review. Freshness and abandonment: not checked.

  • deepmerge — 1 known issues (1 moderate) · dev-only
  • diff — 1 known issues (1 low) · dev-only
  • glob — 2 known issues (2 moderate) · dev-only
  • minimatch — 2 known issues (2 moderate) · dev-only
  • @csstools/color-helpers — unknown licence (MIT-0)
  • glob — unknown licence (BlueOak-1.0.0)
  • lru-cache — unknown licence (BlueOak-1.0.0)
  • minimatch — unknown licence (BlueOak-1.0.0)
  • path-scurry — unknown licence (BlueOak-1.0.0)
  • type-fest — unknown licence ((MIT OR CC0-1.0))
  • caniuse-lite — unknown licence (CC-BY-4.0)
  • exit — unknown licence
  • jackspeak — unknown licence (BlueOak-1.0.0)
  • minipass — unknown licence (BlueOak-1.0.0)
  • argparse — unknown licence (Python-2.0)
  • package-json-from-dist — unknown licence (BlueOak-1.0.0)
  • path-scurry — unknown licence (BlueOak-1.0.0)

Source coverage: Sampled — some eligible source files were omitted

Dependency vulnerability check: Complete

Build not run by CookThisApp.

Suggestions (7)

Most serious first · Page 1

  • glob 13.0.6: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

    Medium — could affect users in some situations; plan a fix.

    Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

    Dependency warning — does not block publishing. Review before use. Scanner severity: medium.

    Fix hint: Update glob from 13.0.6 to 14.0.2 or newer (check compatibility).

    Open

    GHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4 · package-lock.json

  • minimatch 9.0.9: minimatch has potential denial of service via globparts amplification

    Medium — could affect users in some situations; plan a fix.

    minimatch has potential denial of service via globparts amplification

    Dependency warning — does not block publishing. Review before use. Scanner severity: medium.

    Fix hint: Update minimatch from 9.0.9 to 11.0.1 or newer (check compatibility).

    Open

    GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249 · package-lock.json

  • deepmerge 4.3.1: deepmerge mergeObject() allows prototype poisoning of returned objects

    Medium — could affect users in some situations; plan a fix.

    deepmerge mergeObject() allows prototype poisoning of returned objects

    Dependency warning — does not block publishing. Review before use. Scanner severity: medium.

    Fix hint: Update deepmerge to a release that fixes this advisory; no fixed version was supplied by the scan.

    Open

    GHSA-gcqx-w48m-w2h4 · package-lock.json

  • Webview src set from unvalidated URL

    Medium — could affect users in some situations; plan a fix.

    A malicious page or AI-driven navigation could load a javascript: or data: URL into a webview, potentially executing script in a privileged context or exfiltrating data.

    Review finding — does not by itself block publishing.

    Fix hint: Validate the URL protocol before assigning it to a webview src (e.g., allow only http:, https:, about:blank, and the app's own browser:// schemes), and reject javascript:, data:, and file: URLs from untrusted sources.

    Open

    ai-security · tab-manager.js

  • Artifact HTML served with inline script and same-origin API access

    Medium — could affect users in some situations; plan a fix.

    Generated HTML artifacts run with inline script and can call the local artifact API, so a malicious artifact could read or modify other artifacts' data.

    Review finding — does not by itself block publishing.

    Fix hint: Restrict the artifact view CSP to a strict allowlist and avoid 'unsafe-inline' where possible; consider serving user HTML from a separate origin or sandboxed iframe with no access to the artifact API.

    Open

    ai-security · artifact-service.js

Kitchen Report

Current run: generation 1

Orbit Internet Browser · Version 01a1c112-671e-7c40-b039-0cf6550fd678

Report complete.

Live provider analysis

Ordinary dependency advisories are disclosed warnings and allow publication. Harmful source, malicious packages and unresolved rights or license blockers prevent publication.

Features found in source are not proof the app works. Actual run verification: Not tested. License and rights eligibility requires the seller’s declarations; dependency license compatibility: Not checked. Checks do not guarantee safety or production readiness.

Download reportView findings and fixes

Our estimate: $46–80 in AI usage, plus your own time.

How we estimate

We estimate AI usage for repeated edits and context reads, priced at Claude Sonnet 5.5 rates. Repeated reads use the provider's cached-input price.

The developer sets the price; this estimate is guidance only.

Formula v4 · AI usage estimate · 5 rework iterations · 16× context · claude-sonnet-5-5 · Price table 2

Source checks

Source check ✓ 09/11/2026

  1. 1. Unpacking · ✓ Done
  2. 2. Secret scan · ✓ Done
  3. 3. Safety scan (S1) · ✓ Done
  4. 4. Dependency scan (S2) · ✓ Done
For developers: code quality

Improvement hints only; these do not contribute to buyer headline scores.

Architecture / structure: 76 / 100 (AI structure review)

Code cleanliness: 76 / 100 (AI maintainability review)

Test presence: 48 test files found (presence signal only). Coverage: Not checked.

Source size: 44071 LOC (metric, not a scored check).

  • Tab manager is large and mixes DOM, session, and webview concerns; splitting would aid readability. tab-manager.js
  • Artifact service packs routing, storage, and preview into one class; extract handlers for clarity. artifact-service.js
  • Dynamic artifact service uses terse one-line methods; expanding improves maintainability. dynamic-artifact-service.js

Help us improve CookThisApp

0/2000