browser-ui-harness
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The runner script (references/runner-skeleton.sh) dynamically loads and executes test case logic using the Bash source command. Additionally, it uses agent-browser eval to execute JavaScript code within the browser context to perform checks like document.body.innerText.includes().
- [COMMAND_EXECUTION]: The tool orchestrates several external command-line utilities, including agent-browser for web interaction, curl for service health checks, and astroshot-capture for visual regression reporting.
- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by processing data from untrusted external websites defined by APP_BASE_URL.
- Ingestion points: Content is ingested through agent-browser commands that read the page DOM, console logs, and error messages (e.g., in smoke_wait_text and smoke_diagnostics).
- Boundary markers: The skill does not implement specific delimiters to separate application content from agent instructions in the generated reports.
- Capability inventory: The runner has capabilities to execute shell commands, control a browser session, and write files to the local system (artifacts and reports).
- Sanitization: The skill uses jq to safely escape strings before interpolating them into JavaScript eval statements, reducing the risk of script injection into the browser session.
Audit Metadata