tech-stack
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill configures MCP tools (agent-browser, postgres-mcp) that ingest untrusted data from web pages and databases, creating a surface for indirect prompt injection. 1. Ingestion points: Web content via agent_browser_open (references/agent-browser-mcp.md) and database content via DATABASE_URL (references/cursor-mcp.md). 2. Boundary markers: None specified in the instructions or templates. 3. Capability inventory: agent-browser supports navigation, UI interaction, and JavaScript evaluation (agent_browser_eval). postgres-mcp allows SQL query execution. 4. Sanitization: No explicit sanitization or validation logic is provided for ingested data.
- [EXTERNAL_DOWNLOADS]: Recommends installation of development tools from external sources. Evidence: brew install agent-browser, npm install -g agent-browser@^0.27, bunx -y @yawlabs/postgres-mcp@latest. These are well-known or vendor-associated resources.
- [COMMAND_EXECUTION]: Defines scripts for development and CI workflows that execute various CLI tools. Evidence: package.json scripts for oxlint, oxfmt, vitest, and knip.
- [DYNAMIC_EXECUTION]: Mentions tools capable of runtime code evaluation. Evidence: Use of agent_browser_eval in references/agent-browser-mcp.md for agent-driven debugging.
Audit Metadata