browser-harness
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local binaries such as
uv,browser-harness, andchromeusing Python'ssubprocess.runandsubprocess.Popen. These calls are implemented using structured argument lists rather than shell strings, which effectively mitigates command injection risks. - [EXTERNAL_DOWNLOADS]: The skill automates the installation and upgrade of the
browser-harnesspackage using the well-knownuvpackage manager. This is a standard and expected procedure for initializing the skill's core functionality. - [DATA_EXPOSURE]: The skill includes functionality for capturing screenshots and task recordings that might contain sensitive information. It implements a mandatory consent workflow to ensure the user is informed and explicitly opts in before recording features are enabled.
- [DYNAMIC_EXECUTION]: The skill provides a
runmechanism to execute Python code for browser control. The documentation includes clear instructions for the Agent to only execute trusted, self-generated code and to never execute untrusted scripts sourced from web pages.
Audit Metadata