agent-browser
Warn
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting untrusted data from external websites. * Ingestion points: 'agent-browser snapshot' and 'agent-browser get text' in SKILL.md. * Boundary markers: Absent. * Capability inventory: Includes network navigation, file writing (screenshots/state), and browser interactions across all documentation files. * Sanitization: None mentioned for web content.
- [COMMAND_EXECUTION]: The skill operates by executing various commands through the 'agent-browser' CLI in the host's shell.
- [DATA_EXFILTRATION]: The skill provides commands to save and load session states ('state save' and 'state load' in references/authentication.md) which store sensitive tokens and cookies in local files, presenting a credential exposure risk.
- [EXTERNAL_DOWNLOADS]: The documentation suggests installing the 'agent-browser' tool from the npm registry as a prerequisite.
- [REMOTE_CODE_EXECUTION]: The CLI tool supports an 'eval' command, including base64-encoded script execution ('agent-browser eval -b'), which allows for dynamic JavaScript execution within the browser context.
Audit Metadata