agent-browser
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill inherently processes untrusted external content from web pages, console logs, and network data, which constitutes an attack surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through the
snapshot,console, andnetwork requestscommands inSKILL.md. - Boundary markers: The skill contains a dedicated 'Safety' section with explicit instructions to treat all page content, console output, and network bodies as data rather than instructions, specifically directing the agent to ignore embedded requests to navigate or reveal secrets.
- Capability inventory: The skill utilizes the
agent-browserCLI to perform network navigation, UI interaction, and file system operations (writing screenshots, HAR files, and traces). - Sanitization: No technical sanitization (e.g., HTML escaping) is specified, but the skill implements conceptual sanitization through strict instructional boundaries and human-in-the-loop requirements for sensitive actions.
Audit Metadata