agent-browser
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
agent-browserpackage from the NPM registry and references configuration guidelines from Vercel Labs' official GitHub repository. - [COMMAND_EXECUTION]: Utilizes shell commands to manage browser life cycles, including launching Google Chrome with remote debugging flags and interacting with the
agent-browserCLI to perform automation tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites through snapshots and metadata extraction. It mitigates this risk by explicitly instructing the agent to treat all page content as untrusted evidence rather than instructions. Evidence chain: 1. Ingestion points: browser automation commands in SKILL.md. 2. Boundary markers: Explicit instructions to treat page content as untrusted. 3. Capability inventory: Requires file_write access and shell command execution. 4. Sanitization: Recommends summarizing selectors and metadata instead of raw HTML dumps.
- [SAFE]: Implements environment isolation by using temporary directories for browser data, ensuring that automation does not impact the user's primary browser profile or sensitive information.
Audit Metadata