agent-browser
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to install the automation tool using
npm i -g light-agent-browserand initialize it withagent-browser install. It also utilizes several subcommands (e.g.,skills get,skills list) to manage its functionality. - [EXTERNAL_DOWNLOADS]: The skill fetches workflow content, templates, and command references from the vendor's service via the
agent-browser skills get [skill-name]command to ensure instructions remain synchronized with the installed CLI version. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external sources, which creates a potential surface for indirect prompt injection.
- Ingestion points: Arbitrary web pages, Slack conversations, Discord, Figma, and other applications accessible via the browser or Electron automation.
- Boundary markers: The initial stub does not define specific delimiters; these are managed within the core workflows fetched dynamically via the CLI.
- Capability inventory: Navigating pages, filling forms, clicking buttons, extracting data, taking screenshots, and interacting with Slack workspaces or Electron-based desktop apps.
- Sanitization: The documentation does not specify the sanitization or escaping methods used when the agent processes content retrieved from the browser.
- [DYNAMIC_EXECUTION]: Implements a dynamic context loading pattern where the primary instructions and logic ('skills') are retrieved at runtime rather than being statically defined in the SKILL.md file.
Audit Metadata