control-ui
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to drive and inspect web, IDE, or Electron UIs, which involves ingesting data from external, potentially untrusted sources (DOM elements, console logs, network traffic). This creates a surface where malicious instructions embedded in a UI could influence the agent's behavior.
- Ingestion points: Browser content accessed via
page.goto(),page.getByRole(), and extraction of logs or snapshots (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore embedded commands within the ingested UI data.
- Capability inventory: The skill utilizes file system writes (e.g., to
/tmp/), browser control, and local network connections (SKILL.md). - Sanitization: No mention of sanitizing or escaping the content retrieved from the browser before processing.
- [COMMAND_EXECUTION]: The skill provides boilerplate JavaScript code using the Playwright framework. These snippets are intended to be executed by the agent to automate local Chromium or Electron instances. This involves executing code that interacts with the local environment to capture screenshots and logs.
Audit Metadata