browserwing-executor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
/evaluateendpoint allows the agent to execute arbitrary JavaScript code within the browser context. While this is a standard feature for advanced browser automation, it represents a dynamic execution vector that could be exploited if the scripts are constructed using untrusted data. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external websites, creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent's context through the
/snapshot,/extract,/page-text, and/page-contentendpoints inSKILL.md. - Boundary markers: The instructions do not provide specific delimiters or guidance for the agent to distinguish between its instructions and the data extracted from web pages.
- Capability inventory: The skill provides powerful capabilities including JavaScript execution (
/evaluate), form interaction (/type,/click), and navigation (/navigate), which could be targeted by malicious instructions embedded in web pages. - Sanitization: There are no documented procedures for sanitizing or filtering the content retrieved from external sources before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill instructions and examples heavily rely on the use of
curlcommands to interact with the local API, demonstrating an intended workflow that involves shell command execution.
Audit Metadata