qa-browser-data-collector
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to autonomously explore and extract data from external, untrusted web applications via Playwright. This creates a surface for indirect prompt injection attacks where a malicious website could embed instructions to override the agent's behavior.
- Ingestion points: Data is ingested from live web application page structures, forms, accessibility snapshots, and network API responses (
SKILL.md). - Boundary markers: The instructions lack specific delimiters or "ignore embedded instructions" warnings to isolate the agent from instructions found within target web pages.
- Capability inventory: The agent utilizes Playwright MCP tools for browser navigation, interaction (clicks, hovers), and network traffic recording (
references/playwright-mcp-patterns.md). - Sanitization: There is no mention of sanitizing, escaping, or filtering content retrieved from the web before the agent processes it into a UI specification.
Audit Metadata