I am wondering how it solves the security issues: I saw opt-in, file permissions and SSRF in README, but I do not see: domain allowlist; human approval before submiting/deleting; persistent audit record after operations; how to revoke a previously granted access; The prompt injection may also induce the agent to perform write operations. Reuse the real user-login session also delegate the user's full authority to the…
Domain allowlist is in: NEOBROWSER_DOMAIN_ALLOWLIST=github.com,.docs.rs — navigate rejects anything not listed with an error that names the allowed hosts. Exact hosts or .suffix, opt-in (unset = no restriction). Appreciate the push on this one.