browser-trace
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill manages background processes and performs data sampling using Node.js
spawnandexecFileSyncto invoke thebrowseCLI and internal scripts. These operations are properly parameterized and do not use a shell for execution, preventing command injection.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests raw data from the browser, including HTML snapshots and event logs. While this is the intended purpose of a tracing tool, agents that consume these traces in subsequent loops should be aware that the data contains untrusted content from the web.\n - Ingestion points: Browser event streams and page contents are captured via the DevTools Protocol and written to local storage.\n
- Boundary markers: Absent; the tool records high-fidelity raw data for forensic analysis.\n
- Capability inventory: The skill uses
Bash,Read, andGreptools and executes local Node.js scripts.\n - Sanitization: None; the tool provides a transparent record of all browser activity as required for its primary debugging purpose.\n- [EXTERNAL_DOWNLOADS]: The skill retrieves session artifacts (logs and downloaded files) from the Browserbase platform and requires the installation of the
browseCLI tool. These actions are documented requirements for the skill's functionality and target the vendor's own infrastructure.
Audit Metadata