Is MinionLab safe?

Question

Is MinionLab safe?

Accepted Answer

MinionLab is critical risk. Code analysis shows MinionLab can receive task messages from gateway.minionlab.ai, decode a base64 JavaScript field, fetch the task URL, and run the decoded script against the fetched page response. The confirmed verification is based on the shipped code path rather than an observed gateway-dispatched task in the test session. When MinionLab is active on a webpage, its content script accepts page messages marked as st1-dashboard and forwards the embedded request to the extension background without checking the sender origin. Confirmed behavioral evidence shows that a relayed login message reaches the background handler and writes the supplied token into extension storage.

Is MinionLab safe?

Findings