test-browser
Warn
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs shell commands using unvalidated user input for PR numbers and branch names (e.g., 'gh pr view [number]' and 'git diff --name-only main...[branch]'). This creates a surface for command injection if the input is not properly sanitized.
- [DATA_EXFILTRATION]: The skill instructs the agent to read sensitive environment files including '.env', '.env.local', and '.env.production'. While the stated purpose is to find a server port, these files frequently contain high-value secrets and API keys that should not be accessed by automated skills.
- [PROMPT_INJECTION]: The instructions include directives that override standard platform behavior and tools, specifically commanding the agent to ignore built-in browser automation capabilities (e.g., 'do not use Chrome MCP tools') in favor of an external CLI.
- [PROMPT_INJECTION]: The skill ingests untrusted data from external sources like GitHub PR file lists and Git diffs. This processed data influences the 'agent-browser' command routes, creating an indirect prompt injection surface.
- Ingestion points: 'gh pr view' and 'git diff' command outputs.
- Boundary markers: None present.
- Capability inventory: Subprocess execution via 'gh', 'git', and 'agent-browser'.
- Sanitization: No sanitization or validation of the ingested route data is described.
Audit Metadata