agent-browser
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for fetching updates from Vercel's official GitHub repository, which is a trusted source.
- Evidence: curl command targeting raw.githubusercontent.com/vercel-labs/agent-browser/main/skills/agent-browser/SKILL.md in LOCAL-INSIGHTS.md.
- [DYNAMIC_EXECUTION]: The skill includes an eval command that allows the agent to execute JavaScript within the browser context, which is a primary feature for advanced web automation.
- Evidence: agent-browser eval command examples in SKILL.md and LOCAL-INSIGHTS.md, including support for base64-encoded script input.
- [INDIRECT_PROMPT_INJECTION]: As a tool designed to process content from arbitrary websites, the skill inherently possesses an attack surface for indirect prompt injection from untrusted web data.
- Ingestion points: The agent-browser open, snapshot, and get text commands ingest data from the web into the agent's context (SKILL.md).
- Boundary markers: No explicit boundary markers or warnings to ignore embedded instructions are provided in the skill instructions.
- Capability inventory: The skill has the ability to write files (screenshot, pdf, state save), access the network through the browser, and execute JavaScript in the browser context (SKILL.md).
- Sanitization: There is no evidence of specific sanitization or filtering of external web content before processing.
Audit Metadata