agent-browser

Warn

Audited by Gen Agent Trust Hub on Aug 29, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent or user to install a global package (agent-browser) from the public npm registry.
  • [REMOTE_CODE_EXECUTION]: The skill utilizes the agent-browser skills get command to fetch and load workflow instructions and templates from a remote source at runtime, which bypasses static instruction review.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external environments, creating a vulnerability where malicious instructions embedded in those environments could influence the agent's actions.
  • Ingestion points: Data scraped from arbitrary web pages, Slack message history, and the accessibility trees of Electron applications such as Discord, VS Code, and Figma.
  • Boundary markers: The configuration lacks explicit delimiters or instructions to the agent to ignore or isolate instructions found within the processed external data.
  • Capability inventory: The skill enables broad capabilities including browser automation (navigating, form filling, clicking), authenticated session management, and interaction with desktop application UIs.
  • Sanitization: No sanitization, validation, or content filtering mechanisms are defined for the data retrieved from external sources before it is presented to the agent context.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 29, 2026, 08:47 AM
Security Audit — agent-trust-hub — agent-browser