browser-max-automation

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes PowerShell commands such as Start-Process, Get-NetTCPConnection, and taskkill to manage browser lifecycles and debugging endpoints on Windows systems.\n- [DYNAMIC_EXECUTION]: The instructions rely heavily on page.evaluate and raw CDP Runtime.evaluate calls to interact with and manipulate JavaScript execution environments within the browser.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from external websites.\n
  • Ingestion points: Untrusted data enters the agent context via document.body.innerText reads, full page snapshots, and screenshot captures as described in SKILL.md and references/instructions/ui-fallbacks.md.\n
  • Boundary markers: The instructions recommend verifying state through independent signals (DOM, URL, API) rather than relying solely on UI elements, although explicit prompt delimiters for web content are not mandated.\n
  • Capability inventory: The skill allows for significant system interaction, including shell command execution (Start-Process), file system writes (.playwright-mcp/ logs and artifacts), and network operations via the controlled browser.\n
  • Sanitization: Instructions include logic for stripping potential syntax-breaking characters and normalizing extracted text labels to reduce accidental obedience to embedded strings.\n- [PERSISTENCE]: The skill contains instructions for inspecting and potentially modifying Windows Scheduled Tasks using Get-ScheduledTask and Set-ScheduledTask specifically to manage browser launch triggers and ensure automation stability.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 06:31 PM