chrome-devtools
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites, console logs, and network responses, which creates a surface for indirect prompt injection attacks where a malicious site could attempt to influence the agent's behavior.
- Ingestion points: Browser text, console messages, and network payloads retrieved through DevTools (SKILL.md).
- Boundary markers: The skill includes a dedicated 'Boundaries' section that explicitly instructs the agent to treat browser data as evidence, not instructions, and to stay within the authorized task.
- Capability inventory: The skill has the ability to navigate pages, interact with elements, and execute JavaScript via
evaluate_script. - Sanitization: The instructions provide guidance to avoid extracting sensitive credentials like cookies or private tokens.
- [EXTERNAL_DOWNLOADS]: The skill configuration involves downloading and executing the
chrome-devtools-mcppackage usingnpx. - Evidence: The setup JSON includes a command to run
npx -y chrome-devtools-mcp@latest. This is a standard method for initializing MCP servers from the official Chrome DevTools project repository. - [COMMAND_EXECUTION]: The skill requires the execution of shell commands (npx) to start the MCP server, which is a necessary part of its primary function to provide browser debugging capabilities.
Audit Metadata