browserwing-executor

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The /evaluate endpoint allows the agent to execute arbitrary JavaScript code within the browser context. While this is a standard feature for advanced browser automation, it represents a dynamic execution vector that could be exploited if the scripts are constructed using untrusted data.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external websites, creating a surface for indirect prompt injection attacks.
  • Ingestion points: Untrusted data enters the agent's context through the /snapshot, /extract, /page-text, and /page-content endpoints in SKILL.md.
  • Boundary markers: The instructions do not provide specific delimiters or guidance for the agent to distinguish between its instructions and the data extracted from web pages.
  • Capability inventory: The skill provides powerful capabilities including JavaScript execution (/evaluate), form interaction (/type, /click), and navigation (/navigate), which could be targeted by malicious instructions embedded in web pages.
  • Sanitization: There are no documented procedures for sanitizing or filtering the content retrieved from external sources before it is processed by the agent.
  • [COMMAND_EXECUTION]: The skill instructions and examples heavily rely on the use of curl commands to interact with the local API, demonstrating an intended workflow that involves shell command execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 12:22 PM
Security Audit — agent-trust-hub — browserwing-executor