agent-browser
Warn
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent or user to install a global package (
agent-browser) from the public npm registry. - [REMOTE_CODE_EXECUTION]: The skill utilizes the
agent-browser skills getcommand to fetch and load workflow instructions and templates from a remote source at runtime, which bypasses static instruction review. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external environments, creating a vulnerability where malicious instructions embedded in those environments could influence the agent's actions.
- Ingestion points: Data scraped from arbitrary web pages, Slack message history, and the accessibility trees of Electron applications such as Discord, VS Code, and Figma.
- Boundary markers: The configuration lacks explicit delimiters or instructions to the agent to ignore or isolate instructions found within the processed external data.
- Capability inventory: The skill enables broad capabilities including browser automation (navigating, form filling, clicking), authenticated session management, and interaction with desktop application UIs.
- Sanitization: No sanitization, validation, or content filtering mechanisms are defined for the data retrieved from external sources before it is presented to the agent context.
Audit Metadata