Agent Browser
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'agent-browser' utility from the official Vercel Labs GitHub repository and via the NPM registry.
- [DATA_EXFILTRATION]: Provides specific commands to retrieve sensitive browser information, such as 'agent-browser cookies' and 'agent-browser storage local', which can be used to extract session identifiers and authentication tokens.
- [DATA_EXFILTRATION]: The documentation references a specific local file system path ('/home/willr/.config/google-chrome/Default') in example configurations for accessing Chrome profiles. While presented as an example, referencing specific user directories can lead to unintended exposure of local profile data.
- [REMOTE_CODE_EXECUTION]: Includes an 'eval' command that allows for the execution of arbitrary JavaScript code within the context of the active browser session, which is a powerful capability for runtime code execution.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and extracts text from arbitrary, untrusted web pages.
- Ingestion points: Web content ingested via 'agent-browser open', 'agent-browser snapshot', and various 'get' commands.
- Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between system instructions and processed web data.
- Capability inventory: The agent can write to the local file system (screenshots/PDFs), execute CLI commands, and run browser-side scripts.
- Sanitization: No explicit sanitization or validation of the extracted web content is documented.
Audit Metadata