opencli-browser
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the 'opencli' utility via the 'Bash' tool. This tool is explicitly authorized in the 'allowed-tools' frontmatter configuration for tasks such as browser diagnostics and interaction.\n- [DYNAMIC_EXECUTION]: The skill provides instructions for using 'browser eval' to execute JavaScript within the browser's context. This is intended for targeted data extraction and is accompanied by guidelines advising the agent to keep these operations read-only via IIFEs.\n- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting untrusted content from the web via browser state and network capture commands.\n
- Ingestion points: Data enters the agent's context through 'browser state', 'web read', and 'browser network' commands described in 'SKILL.md'.\n
- Boundary markers: The CLI returns structured JSON envelopes which help delineate tool output, but there are no specific prompt delimiters or instructions for the agent to ignore embedded natural language commands within the web-sourced text itself.\n
- Capability inventory: The agent has access to 'Bash', 'Read', 'Edit', and 'Write' tools, which could be leveraged if it follows malicious instructions from a website.\n
- Sanitization: No sanitization or escaping of the extracted web content is described in the skill instructions.
Audit Metadata