test-browser
Warn
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes logic in the agent-browser-runbook.md to read from .env, .env.local, and .env.development files to detect the PORT variable. These files are typically reserved for sensitive configuration and credentials, and any automated access to them is a security risk.
- [EXTERNAL_DOWNLOADS]: The runbook instructs the agent to install an external package globally from the npm registry (npm install -g agent-browser). This package is not associated with a trusted vendor or well-known service listed in the security profile.
- [COMMAND_EXECUTION]: The skill relies on executing various shell commands to detect server ports, check tool availability, and interact with version control systems via git and the GitHub CLI (gh).
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting untrusted data from pull request metadata and file names to derive execution routes. Ingestion points: Pull request metadata retrieved via gh pr view and file paths from git diff. Boundary markers: No delimiters or warnings are present to instruct the model to ignore potential instructions embedded in the PR data. Capability inventory: The agent can execute shell commands and perform browser automation. Sanitization: No validation or escaping is applied to the data retrieved from external commands before it is used in subsequent operations.
Audit Metadata