claude-in-chrome
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection attacks because it ingests data from external, untrusted web sources.
- Ingestion points: The agent is instructed to use
mcp__claude-in-chrome__read_page,mcp__claude-in-chrome__read_console_messages, andmcp__claude-in-chrome__read_network_requeststo gather information from the browser. - Boundary markers: There are no instructions for the agent to use delimiters or ignore embedded instructions within the retrieved web content.
- Capability inventory: The agent can execute scripts (
mcp__claude-in-chrome__javascript_tool), fill forms (mcp__claude-in-chrome__form_input), and navigate to arbitrary URLs. - Sanitization: The skill does not provide any mechanisms for sanitizing or filtering external content before it enters the agent's context.
- [COMMAND_EXECUTION]: The skill provides access to
mcp__claude-in-chrome__javascript_tool, which enables the execution of arbitrary JavaScript within the browser context. This allows for dynamic code execution on any page the agent navigates to. - [DATA_EXFILTRATION]: The tools
mcp__claude-in-chrome__read_console_messagesandmcp__claude-in-chrome__read_network_requestsallow the agent to capture potentially sensitive technical data, including API keys, tokens, or session identifiers that may appear in logs or network traffic.
Audit Metadata