agent-browser
Warn
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to install the
agent-browserpackage globally from the npm registry. It also fetches additional 'skills' or workflows from a remote source using theagent-browser skills getcommand. - [COMMAND_EXECUTION]: The skill instructions require the agent to execute several shell commands, including tool installation (
npm i -g agent-browser), initialization (agent-browser install), and workflow retrieval (agent-browser skills get core). - [REMOTE_CODE_EXECUTION]: The skill uses a 'discovery stub' pattern where the primary instructions and logic are loaded dynamically from a remote CLI at runtime. This practice of fetching and interpreting remote instructions allows the skill's behavior to change without an update to the repository, bypassing static security audits of the browser automation tasks.
Audit Metadata