ToDesk AI Chrome extension security report

ToDesk AI is a browser automation extension that lets your local AI agent or automation script take full control of Chrome through a secure local WebSocket connection. No cloud. No remote servers. Everything runs on your own machine. ── HOW IT WORKS ── ToDesk AI listens for commands on a local WebSocket server (ws://localhost). Your application sends JSON-RPC 2.0 requests; ToDesk AI executes them in Chrome and returns results in real time. Any programming language that supports WebSockets can drive the browser. ── 68+ BROWSER CONTROL METHODS ── 🖱️ Interaction • Click elements by index or pixel coordinates • Type text into any input field • Scroll pages and individual scrollable containers • Drag and drop, hover, double-click, right-click • Send keyboard shortcuts (Enter, Tab, Escape, Ctrl+A, …) • Upload files to file input fields • Select options from dropdown menus 🧭 Navigation • Navigate to any URL • Go back / forward in history • Web search (Google, Bing, DuckDuckGo) • Open links in new or existing tabs 🔍 Inspection & Content Extraction • Capture viewport or full-page screenshots (PNG) • Generate accessibility-tree snapshots — AI-friendly structured page representations • Extract full page text content • Search page text with plain string or regex • Find elements by CSS selector • Evaluate JavaScript expressions in the page context 🍪 Session & Storage Management • Export and import cookies, localStorage, and sessionStorage • Restore complete browser sessions for authenticated workflows 📊 Built-in Activity Dashboard • Full history of every automation action with timestamps and durations • Inline screenshots and result previews • Paginated log with search, filtering, and a detail panel • Image lightbox with zoom and pan ── PRIVACY & SECURITY ── ToDesk AI communicates exclusively with your local machine (ws://127.0.0.1). Every connection requires a cryptographic handshake — the extension and server exchange an HMAC-SHA256 signed timestamp, so only the companion local server can establish a session; web pages and third-party processes cannot connect. No page data, screenshots, or personal information is ever transmitted to external servers. Operation history is stored locally in Chrome's extension storage and can be cleared at any time from the dashboard. ── USE CASES ── • Connect AI coding assistants and agents to browse, research, and interact with the web • Automate repetitive web workflows — form filling, data entry, reporting • Web testing and QA automation pipelines • Data extraction and structured research tools • Build custom automation with Python, Node.js, or any language ── GETTING STARTED ── 1. Install ToDesk AI and click the toolbar icon to open the dashboard 2. Start your local automation server or AI agent that connects to ws://localhost 3. The extension connects automatically and executes commands as they arrive 4. Watch every action logged live in the dashboard