visual-web-qa
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes agent-browser via the bash tool to perform UI verification tasks, such as taking screenshots and recording videos. These operations are restricted to the intended purpose of visual QA.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by rendering external web pages. This presents a theoretical indirect prompt injection surface.
- Ingestion points: Rendered web content and DOM state captured via agent-browser and snapshot commands as described in SKILL.md.
- Boundary markers: Absent. The instructions do not define specific delimiters for separating web content from agent instructions, but the skill follows a structured reporting format.
- Capability inventory: The skill uses bash (to call agent-browser), sendFiles, and publishImage to process and share the ingested content.
- Sanitization: The skill enforces manual sanitization through instructions that mandate the inspection of screenshots for sensitive data using viewImage before they are shared or published. It explicitly forbids the capture of session tokens, PII, or credentials.
Audit Metadata