browser-search-and-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because its core function involves browsing and extracting data from untrusted external portals and marketplaces.
- Ingestion points: The agent browses external websites and portal listings to collect matching entities as described in
SKILL.md(Step 3) andreferences/criteria-patterns.md. - Boundary markers: The skill explicitly defines an "automation boundary" in
SKILL.md(Step 6), listing specific human-only checkpoints (CAPTCHA, OTP, payments) which mitigates the risk of the agent performing unauthorized actions due to malicious instructions embedded in a webpage. It lacks, however, specific prompt-level delimiters to segregate untrusted content. - Capability inventory: The workflow utilizes web browsing (
agent-browser), local file writing (CSV trackers), and interaction with form fields. - Sanitization: The skill instructs the agent to normalize attributes into a tracker but does not specify technical sanitization or escaping of the scraped HTML/text content before it is processed by the model.
Audit Metadata