stagehand
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill enables an agent to browse and interact with external, untrusted web content which can be used to influence agent behavior.\n
- Ingestion points: Interaction with untrusted web content occurs through the
page.goto(url)method and subsequent AI-driven interactions likepage.act()andpage.extract()(found inSKILL.md).\n - Boundary markers: The skill suggests quoting literal text in instructions, but lacks explicit delimiters or instructions to the agent to ignore commands embedded in the data-plane (found in
SKILL.md).\n - Capability inventory: The skill provides browser automation capabilities including navigation, element interaction, and structured data extraction from arbitrary URLs (found in
SKILL.md).\n - Sanitization: No mechanisms are described for sanitizing the text or HTML content of target websites before it is processed by the underlying AI model (found in
SKILL.md).\n- [EXTERNAL_DOWNLOADS]: The skill relies on external libraries for its core browser automation functionality.\n - Dependencies: Uses the
stagehandand@browserbasehq/stagehandpackages, which are the official libraries for the Stagehand automation framework, as well as thezodlibrary for schema validation.
Audit Metadata