dogfood
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with and processes content from external, untrusted websites, creating a surface for indirect prompt injection attacks.
- Ingestion points: The agent reads page content, browser logs, and interactive element data from a user-provided
TARGET_URLusingagent-browsercommands (e.g.,snapshot,console) as instructed inSKILL.md. - Boundary markers: The instructions in
SKILL.mdlack delimiters or specific warnings to prevent the agent from obeying instructions that may be maliciously embedded in the target site's HTML, text, or metadata. - Capability inventory: As defined in
SKILL.md, the skill can perform complex browser interactions (click, type, fill), capture screenshots and video recordings, and write reports and authentication state (auth-state.json) to the local filesystem. - Sanitization: No sanitization or filtering logic is defined to check the web content before the agent processes and acts upon it.
Audit Metadata