agent-browser-interaction-debugging
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous command patterns for the
agent-browserCLI tool to perform actions like taking snapshots, navigating pages, and interacting with elements. These commands are part of the core functionality intended for local debugging. - [INDIRECT_PROMPT_INJECTION]: The skill documents methods to ingest and act upon untrusted data from external web pages (via snapshots, console logs, and network requests), which constitutes a vulnerability surface for indirect prompt injection.
- Ingestion points: Page snapshots, console logs, and network request data (
references/01-snapshots-refs-waits.md,references/03-flaky-tooling-environment.md). - Boundary markers: The instructions do not define technical delimiters for separating untrusted browser content from agent instructions.
- Capability inventory: The agent-browser tool is used for actions such as
click,fill, and executing diagnostic JavaScript viawait --fn(references/01-snapshots-refs-waits.md). - Sanitization: The skill advocates for human-in-the-loop review, reproduction in headed mode, and explicit checks to ensure artifacts are free of secrets before they are shared or reported.
- [DYNAMIC_EXECUTION]: The skill utilizes the
wait --fncommand pattern to execute diagnostic JavaScript within the browser context to synchronize with application states. This is a low-risk pattern used specifically for browser-side state checks.
Audit Metadata