agent-browser
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of fetching and processing untrusted external web content while maintaining significant automation capabilities.
- Ingestion points: Multiple commands and templates, such as
agent-browser open,agent-browser snapshot, andagent-browser get text(found inSKILL.md,references/commands.md, andtemplates/capture-workflow.sh), bring arbitrary web data into the agent's context. - Capability inventory: The
agent-browserCLI provides broad capabilities, including full browser automation, Electron desktop app automation (VS Code, Slack, Discord), credential management, and arbitrary JavaScript execution viaagent-browser eval(as documented inSKILL.mdandreferences/commands.md). These capabilities could be abused if the agent follows instructions hidden within a retrieved web page. - Boundary markers: The skill's instructions and templates do not currently define delimiters or specific safety instructions to help the agent distinguish its primary task from potentially malicious directives embedded in external web content.
- Sanitization: There are no mechanisms described for sanitizing or filtering the content retrieved from web pages before it is processed by the agent.
Audit Metadata