agent-browser
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting untrusted data from external websites via the browsing functions. This flags the potential attack surface rather than confirmed malicious behavior.\n
- Ingestion points: Web content is returned to the agent context through functions such as
open,snapshot, andexecute.\n - Boundary markers: The provided templates do not demonstrate use of delimiters or clear instructions for the agent to ignore instructions embedded in the retrieved web data.\n
- Capability inventory: The agent has extensive capabilities including shell execution via the
beltCLI, potential file system interaction via the browser, and network operations.\n - Sanitization: No explicit sanitization or filtering of external content is shown in the provided automation scripts.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands using the
belt(orinfsh) CLI to perform browser operations.\n- [REMOTE_CODE_EXECUTION]: The skill includes anexecutefunction which allows the agent to run arbitrary JavaScript within the browser context for page manipulation and data extraction.\n- [EXTERNAL_DOWNLOADS]: The documentation refers to external resources for setup, including a GitHub-hosted installation script and a CLI tool installed vianpx.
Audit Metadata