browser-qa
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes data from external websites.
- Ingestion points: The skill navigates to and analyzes target URLs provided at runtime (SKILL.md).
- Boundary markers: There are no instructions provided to delimit external content or ignore embedded instructions within the pages.
- Capability inventory: The skill utilizes powerful browser automation tools (claude-in-chrome, Playwright, Puppeteer) capable of clicking, typing, and form submission (SKILL.md).
- Sanitization: No sanitization or validation of the ingested web content is performed before the agent processes it.
- [DATA_EXFILTRATION]: The skill describes a high-risk surface for potential credential exposure or data leakage.
- Evidence: Phase 2, Step 4 explicitly directs the agent to test authentication flows (login, protected pages, logout), which requires handling sensitive credentials in an automated environment (SKILL.md).
- [COMMAND_EXECUTION]: The skill suggests the use of direct Puppeteer scripts and browser MCP tools to perform actions.
- Evidence: Mention of direct Puppeteer scripts and Playwright via mcp-browserbase indicates the execution of browser commands and scripts to interact with live environments (SKILL.md).
Audit Metadata