plan
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill framework is designed to ingest and process untrusted external data from web content (via BrowserOS) while maintaining powerful capabilities for file system modification and command execution.
- Ingestion points: Web content and external data ingested via BrowserOS tools.
- Boundary markers: The instructions include a policy to treat external data as "hostile," which serves as a high-level instruction but lacks technical delimiters or markers for the ingested data itself.
- Capability inventory: Terminal access via the ExecutionProxy and file writing via the MemoryStore interface.
- Sanitization: The skill mandates redacting PII and secrets before sharing context with subagents, but does not provide technical sanitization for escaping malicious instructions within the data.
- [COMMAND_EXECUTION]: The skill implements a terminal interface (ExecutionProxy) for running commands like
npm test. While intended for developer workflows and testing, this provides a mechanism for the agent to execute code on the host system.
Audit Metadata