browserless
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests and processes untrusted content from the public internet which is then returned to the agent's context.
- Ingestion points: Untrusted data enters the agent context through the
page.textSampleandpage.interactiveElementsfields returned byscripts/browserless.mjsin its debug and scrape reports. - Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to ignore instructions embedded within the scraped content.
- Capability inventory: The
scripts/browserless.mjsscript has the capability to write files to the local filesystem (--output), manage sensitive credentials (config add), and execute arbitrary logic on remote Browserless instances. - Sanitization: Absent. The script returns raw text samples and DOM attributes from remote pages without filtering or escaping content to prevent instruction hijacking.
- [COMMAND_EXECUTION]: The bundled Node.js script allows the agent to write binary or text data (such as screenshots, PDFs, and HTML content) to arbitrary file paths on the local system using the
--outputparameter, which could be exploited if the agent is misled by malicious input. - [EXTERNAL_DOWNLOADS]: The skill facilitates communication with external Browserless API endpoints. While these operations are fundamental to its purpose, they involve sending user-provided authentication tokens to remote servers.
Audit Metadata