browser-use
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the browser-use CLI tool via the Bash tool to perform browser automation.
- [DATA_EXFILTRATION]: Features like cookies export and profile sync allow for the extraction and transfer of sensitive browser session data, including cookies and login states.
- [DYNAMIC_EXECUTION]: The skill provides python and eval commands which allow for the execution of arbitrary Python scripts and JavaScript within the browser context.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted content from external URLs which can then interact with powerful capabilities like shell access and script execution.
- Ingestion points: browser-use open, browser-use get html, browser-use state (SKILL.md).
- Boundary markers: None identified.
- Capability inventory: Shell access (Bash), Python execution (python), JavaScript execution (eval), file writing (screenshot, cookies export), and network operations (SKILL.md).
- Sanitization: No sanitization or filtering of external content is documented.
Audit Metadata