browserwing-admin
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a Linux signing key from Google's servers and adds a remote repository to the system's package manager configuration during the installation phase.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands for system administration and troubleshooting, including:
- Package management commands (
apt-get update,apt-get install,brew install). - Process management and inspection (
pkill,lsof,netstat). - Log analysis (
tail,grep). - Browser invocation (
google-chrome --version). - [PRIVILEGE_ESCALATION]: Several commands provided in the installation section require the use of
sudoto perform actions with root privileges, such as adding repository keys and installing system packages. - [DATA_EXFILTRATION]: The skill provides comprehensive tools for managing browser session data, including the ability to view, export, and import browser cookies. This functionality allows the agent to access potentially sensitive session tokens and authentication data. Additionally, the troubleshooting section encourages reading application logs which may contain sensitive runtime information.
- [DYNAMIC_EXECUTION]: The core functionality of the skill involves creating, replaying, and managing browser automation scripts. These scripts can contain custom logic and JavaScript (
execute_js) that are executed within the browser environment at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface through its AI-driven exploration and script execution features.
- Ingestion points: The agent ingests content from external websites via the
ai-exploreAPI and browser script execution results (SKILL.md). - Boundary markers: None identified; there are no explicit instructions to the agent to disregard instructions embedded in the website data it processes.
- Capability inventory: The skill has access to browser control, cookie management, shell command execution, and API-based script management.
- Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external websites before it is processed by the agent.
Audit Metadata