pr-evidence-comment
Warn
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill launches a local instance of Google Chrome with a remote debugging port enabled (
--remote-debugging-port=9222) and a dedicated user data directory (--user-data-dir="$HOME/.agent-chrome-profile"). This configuration allows the agent to programmatically control a browser session that persists user authentication. - [CREDENTIALS_UNSAFE]: Instructions direct the agent to read and parse the
.env.localfile to extract sensitive values like email addresses for automated form interaction using shell commands likeawkandtr. - [INDIRECT_PROMPT_INJECTION]: The skill represents an indirect injection surface by ingesting and processing untrusted data from external web pages.
- Ingestion points: Web page content is processed via
agent-browser snapshot -iand visual screenshots. - Boundary markers: None implemented for web content processing.
- Capability inventory: The agent has capabilities for browser interaction (
fill,upload,click), local file manipulation, and executing shell commands via Bash. - Sanitization: While the skill includes instructions for manual human review (Step 2.5), there is no automated sanitization of external content before processing.
- [PRIVILEGE_ESCALATION]: By using the Chrome DevTools Protocol (CDP) to attach to a session where the user has manually logged in, the agent inherits the user's active session permissions on GitHub, effectively bypassing API restrictions and automation detection filters like those used by SSO providers.
Audit Metadata