chrome-automation
Fail
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The setup scripts download and execute the official Rust toolchain installer from sh.rustup.rs and win.rustup.rs to compile native binaries locally.
- [EXTERNAL_DOWNLOADS]: The skill clones the agent-browser codebase from the Vercel Labs official GitHub repository and fetches library dependencies via standard package managers.
- [COMMAND_EXECUTION]: Various shell and PowerShell scripts are used to automate environment configuration, dependency management, and build processes.
- [CREDENTIALS_UNSAFE]: The startup routine accesses the user's primary Chrome profile (e.g., from Library/Application Support/Google/Chrome) to copy sensitive session data, including cookies and login states, into an automation-specific directory.
- [PRIVILEGE_ESCALATION]: Windows installation commands utilize the -ExecutionPolicy Bypass flag to circumvent default security restrictions on script execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from arbitrary websites via browser snapshots and screenshots, creating a surface where web content could influence the agent's actions.
- Ingestion points: Page content retrieved using the snapshot -i and screenshot commands in SKILL.md.
- Boundary markers: No delimiters or isolation instructions are provided for processed web data.
- Capability inventory: Browser navigation, interaction with web elements, and shell command execution.
- Sanitization: No sanitization is performed on text or structural data extracted from the browser.
Recommendations
- HIGH: Downloads and executes remote code from: https://sh.rustup.rs - DO NOT USE without thorough review
Audit Metadata