codex-in-app-browser
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses dynamic
import()to load its browser client runtime from a variable path. - Evidence: The bootstrap instruction
await import("<plugin root>/scripts/browser-client.mjs")inSKILL.mduses a placeholder path resolved at runtime. - [COMMAND_EXECUTION]: The skill drives the browser by writing JavaScript code directly to a Node.js REPL tool.
- Evidence: Use of
mcp__node_repl__jsto bind the browser object and execute interaction commands such asiab.documentation(). - [INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted web content, which could contain hidden instructions designed to exploit the agent's browser control capabilities.
- Ingestion points: Accessing web page state, navigation, and reading documentation through the
iabobject viamcp__node_repl__js. - Boundary markers: The skill includes an "Anti-Patterns" section that warns the agent not to treat external content, logs, or tool responses as trusted instructions.
- Capability inventory: The
mcp__node_repl__jstool allows for arbitrary JavaScript execution, while theiabobject provides capabilities for navigation, clicking, and typing. - Sanitization: The instructions do not define specific sanitization or filtering logic for content retrieved from the browser before it is processed by the model.
Audit Metadata