using-agent-browser
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill executes
sudo apt-get install -y espeak-ngto install system-level packages, which requires elevated permissions. - [DYNAMIC_EXECUTION]: The skill dynamically generates a shell script at
/tmp/chrome-desktop-pointer.sh, modifies its permissions usingchmod +x, and executes it as a wrapper for the browser. - [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for navigating to and interacting with external URLs (e.g.,
page.goto(url),agent-browser ... open "<url>"), creating an attack surface where instructions embedded in web content could influence the agent. - Ingestion points: Browser navigation to user-provided or external URLs in
SKILL.md. - Boundary markers: Absent.
- Capability inventory:
agent-browser,npm,npx,sudo,eval,batch(all inSKILL.md). - Sanitization: No explicit sanitization or filtering of web content mentioned.
- [EXTERNAL_DOWNLOADS]: The skill downloads the
playwrightpackage from the NPM registry and installs WebKit browser binaries vianpx. These resources are provided by Microsoft, a well-known technology provider. - [COMMAND_EXECUTION]: The skill uses various shell commands for environment setup, file manipulation, and session management (e.g.,
ls,sort,tail,mkdir,trap).
Recommendations
- AI detected serious security threats
Audit Metadata