skills/oldwinter/skills/agent-browser/Gen Agent Trust Hub

agent-browser

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the agent-browser package from the public NPM registry using npm i -g agent-browser.
  • [REMOTE_CODE_EXECUTION]: The skill utilizes the agent-browser skills get command to dynamically fetch and load workflow instructions, templates, and specialized automation modules (such as Slack and Electron integrations) from the tool vendor's remote repository at runtime.
  • [INDIRECT_PROMPT_INJECTION]: This skill facilitates the processing of untrusted data from external sources, which presents a surface for indirect prompt injection attacks.
  • Ingestion points: Public web pages, accessibility trees, Slack workspace messages, and UI elements of various Electron applications (e.g., Discord, VS Code, Slack).
  • Boundary markers: No explicit delimiters or "ignore" instructions for external content are provided in this discovery stub.
  • Capability inventory: Full browser interaction (navigation, clicking, typing), screenshot capture, and data extraction, combined with the ability to execute shell commands via the Bash tool.
  • Sanitization: No explicit sanitization or filtering logic is documented for the ingested external content.
  • [COMMAND_EXECUTION]: The skill relies on the Bash tool to perform CLI operations and manage the browser environment through the agent-browser command.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 01:53 PM