automation-browser
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone an external third-party repository from GitHub (
https://github.com/zhexulong/openreverse.git) and run its installation scripts. This introduces unverified code into the execution environment that is not managed by standard package registries. - [REMOTE_CODE_EXECUTION]: In
cheatsheet.md, the documentation provides commands to install and initialize the OpenReverse toolset (npm run init:agents,npm run install:cua-runtime,npm run install:mitmproxy). Executing these build and installation scripts from a cloned repository constitutes remote code execution of unverified logic. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and process data from untrusted web pages and desktop application UI trees.
- Ingestion points: Browser snapshots (
agent-browser snapshot), accessibility tree readings, and Windows control tree dumps (openreverse uia tree) inSKILL.mdandcheatsheet.md. - Boundary markers: The skill uses an accessibility tree reference system (
@e1,@e2) which provides a level of abstraction between raw DOM content and the agent's actions. - Capability inventory: The skill utilizes the Playwright Node API and
agent-browserCLI, which have the capability to perform network requests, extract local storage/cookies, and take screenshots. - Sanitization: There is no explicit sanitization or filtering of the content retrieved from target pages before it is processed by the agent.
Audit Metadata