browser-test
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from arbitrary web pages, which could contain instructions intended to influence the agent's behavior.
- Ingestion points: Web content retrieved via
agent-browser(SKILL.md). - Boundary markers: The skill does not explicitly use delimiters in its prompts, but it relies on a technical guard script to restrict sub-agent actions.
- Capability inventory: The agent has access to
Bashandagent-browserCLI, as well as filesystem writes for screenshots and logs (scripts/guard-browser.py). - Sanitization: The
scripts/guard-browser.pyscript implements a "PreToolUse" guard that enforces a strict allow-list of read-only browser verbs, safe flags, and origin-matching navigation. - [COMMAND_EXECUTION]: The skill uses shell commands to initialize testing environments and drive browser automation.
- The
scripts/start-run.shscript sets up the local environment and directory structure. - The
scripts/test_guard_browser.pytest suite usessubprocess.runto validate the security guard functionality.
Audit Metadata