browser-harness
Warn
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to clone an external repository (https://github.com/browser-use/browser-harness.git) and perform an editable installation using 'pip install -e .'. This process allows for the execution of arbitrary Python code from an external source at runtime.\n- [EXTERNAL_DOWNLOADS]: Downloads project files and potential unpinned dependencies from a GitHub organization (browser-use) that is not included in the platform's trusted vendor list.\n- [COMMAND_EXECUTION]: Instructions provide specific shell commands to start Chrome or Chromium with the '--remote-debugging-port=9222' flag. This exposes the Chrome DevTools Protocol to the agent, enabling full programmatic control over browser navigation, data, and sessions.\n- [PROMPT_INJECTION]: As the skill is designed to navigate and process arbitrary web content, it is susceptible to indirect prompt injection where malicious websites could provide instructions to the agent.\n
- Ingestion points: Browser DOM state, page text, and metadata accessed via CDP or WebFetch during automation tasks (SKILL.md).\n
- Boundary markers: No explicit markers or 'ignore' instructions are provided to sanitize content extracted from web pages.\n
- Capability inventory: Full access to Bash, Write, Edit, and network tools (WebFetch), which could be misused if the agent obeys instructions embedded in web content.\n
- Sanitization: Lacks evidence of any sanitization or validation of external browser data before it is incorporated into the agent's context.
Audit Metadata