built-in-browser
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes tools (read_page, get_page_text, find) that ingest data from untrusted external websites into the agent's context. This creates a vulnerability surface where a malicious website could embed instructions designed to override the agent's behavior.
- Ingestion points: Data enters the agent's context through the
read_pageandget_page_texttools which retrieve text and structure from external URLs. - Boundary markers: The skill instructions do not specify the use of delimiters (e.g., XML tags or triple quotes) or explicit "ignore embedded instructions" warnings when processing the retrieved web content.
- Capability inventory: The agent has access to sensitive capabilities including navigation (
navigate), form interaction (form_input), and taking screenshots (computer), which could be misused if the agent is compromised by malicious site content. - Sanitization: There is no evidence of content sanitization or filtering mentioned in the provided instructions to mitigate the risk of embedded instructions.
Audit Metadata