chrome-browser-automation
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill allows the agent to navigate to arbitrary URLs and ingest content, which provides an entry point for malicious instructions embedded in external web pages (e.g., via hidden text or HTML comments).
- Ingestion points: In
SKILL.md, the skill uses theget_page_textandread_pageMCP tools to retrieve content from any user-specified or discovered URL. - Boundary markers: The instructions do not prescribe the use of delimiters (such as XML tags or unique markers) or explicit 'ignore embedded instructions' prompts when handling the external data.
- Capability inventory: The agent has the capability to write files (
Write), modify existing source code (Edit), and perform complex browser interactions (computer,form_input), which could be abused if the agent obeys instructions found on a malicious website. - Sanitization: There is no evidence of sanitization, filtering, or validation of the fetched web content before it is processed by the model.
Audit Metadata