chrome-cdp
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates arbitrary JavaScript execution within an active browser tab using the
evalcommand and permits raw DevTools Protocol methods viaevalraw. This provides a high level of control over the browser session. - [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by retrieving and processing content from external websites (via
html,snap, andshotcommands). Maliciously crafted content on these pages could potentially influence the agent's behavior. - Ingestion points: Browser-derived data processed by the script in
scripts/cdp.mjsand returned to the agent context. - Boundary markers: The skill instructions do not specify the use of delimiters or instructions to ignore embedded commands within the retrieved page content.
- Capability inventory: Powerful browser automation tools including
eval(JavaScript execution),nav(navigation), simulated input (clickandtype), and raw DevTools Protocol access (evalraw). - Sanitization: While arguments are JSON-encoded before being sent to the browser, the data retrieved from the web pages is not sanitized or filtered for embedded instructions before being provided to the agent.
Audit Metadata