agent-browser
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The
evalcommand enables the execution of arbitrary JavaScript within the browser context, supporting Base64 and stdin inputs to bypass shell escaping. This provides a powerful vector for running scripts that could be malicious if derived from untrusted sources. - [INDIRECT_PROMPT_INJECTION]: The skill's ability to ingest web content via navigation and snapshots creates a vulnerability to indirect prompt injection. A malicious website could embed instructions to manipulate the agent's actions through the available browser tools.
- [COMMAND_EXECUTION]: Using a CLI for browser automation involves executing shell commands. This requires careful handling of data interpolated into these commands to prevent shell injection or the execution of unintended logic.
- [CREDENTIALS_UNSAFE]: The
state savecommand persists session cookies and local storage to disk. While the documentation provides warnings, these files represent sensitive targets that could be targeted for credential theft. - [EXTERNAL_DOWNLOADS]: The skill references the installation of
agent-browserandappiumfrom the npm registry, which are well-known tools for web and mobile automation.
Audit Metadata