browser-automation
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses the sensitive file path "~/.claude/.env" to retrieve credentials for automated login workflows.
- [COMMAND_EXECUTION]: Leverages the "browser_evaluate" tool to run dynamic JavaScript within the browser context, which allows for complex interactions but introduces a risk of arbitrary code execution if the agent is directed to run untrusted logic.
- [PROMPT_INJECTION]: Vulnerable to indirect prompt injection through web content ingestion.
- Ingestion points: Untrusted data enters the agent context via the "browser_snapshot" tool.
- Boundary markers: None identified to distinguish web content from system instructions.
- Capability inventory: Includes the "Write" tool for file system access and "browser_evaluate" for script execution.
- Sanitization: No evidence of sanitization, filtering, or validation of the scraped content before it is processed by the agent.
Audit Metadata