dogfood
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill manages sensitive user information required for application testing.
- Credentials handling: Instructions guide the agent to input user-provided credentials (email, password) into the target website.
- Local storage: The agent saves session authentication states to a local file named "auth-state.json".
- Sensitive content: Captured screenshots and videos are stored in a local directory, which may contain PII or other sensitive data from the application being tested.
- [PROMPT_INJECTION]: The skill explores and interacts with external web content, creating a surface for indirect prompt injection attacks.
- Ingestion points: Application content is retrieved via "chrome-use snapshot" and "chrome-use screenshot" in "SKILL.md".
- Boundary markers: There are no explicit instructions to distinguish between the agent's core testing objectives and instructions that might be present in the target application's content.
- Capability inventory: The agent has shell access to manage local files and full browser control through the "chrome-use" tool.
- Sanitization: Content retrieved from the target application is not filtered or sanitized before it is processed by the agent.
Audit Metadata