codex-in-app-browser

Warn

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses dynamic import() to load its browser client runtime from a variable path.
  • Evidence: The bootstrap instruction await import("<plugin root>/scripts/browser-client.mjs") in SKILL.md uses a placeholder path resolved at runtime.
  • [COMMAND_EXECUTION]: The skill drives the browser by writing JavaScript code directly to a Node.js REPL tool.
  • Evidence: Use of mcp__node_repl__js to bind the browser object and execute interaction commands such as iab.documentation().
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted web content, which could contain hidden instructions designed to exploit the agent's browser control capabilities.
  • Ingestion points: Accessing web page state, navigation, and reading documentation through the iab object via mcp__node_repl__js.
  • Boundary markers: The skill includes an "Anti-Patterns" section that warns the agent not to treat external content, logs, or tool responses as trusted instructions.
  • Capability inventory: The mcp__node_repl__js tool allows for arbitrary JavaScript execution, while the iab object provides capabilities for navigation, clicking, and typing.
  • Sanitization: The instructions do not define specific sanitization or filtering logic for content retrieved from the browser before it is processed by the model.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 9, 2026, 03:52 AM
Security Audit — agent-trust-hub — codex-in-app-browser