agent-browser
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external websites.
- Ingestion points: The agent navigates to arbitrary URLs using
agent-browser openand reads page content viaagent-browser snapshot. - Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish between the skill's commands and instructions found on a web page.
- Capability inventory: The skill allows writing sensitive session data to the file system via
agent-browser state save <file>and capturing visual data viaagent-browser screenshot. - Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the browser before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill defines a set of CLI commands (
agent-browser) to control a headless or headed browser environment. These commands allow for full interaction with web content, including form submission and session state persistence.
Audit Metadata