cdp-bridge-mcp-browser-control
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: Provides the
browser_cookiestool, which allows the agent to read session tokens and sensitive data from the user's active, authenticated browser sessions. - [COMMAND_EXECUTION]: Includes the
browser_execute_jstool, enabling the execution of arbitrary JavaScript code within the context of any open browser tab. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The
browser_scantool reads untrusted content from the current webpage (DOM) directly into the agent's context. - Boundary markers: No explicit delimiters or instructions are provided to the model to ignore instructions embedded within the scanned webpage content.
- Capability inventory: The agent has access to powerful capabilities (cookie access, JS execution, navigation) that can be misused if the model is compromised by content it reads.
- Sanitization: The skill performs HTML filtering for token reduction but does not mention sanitizing content to prevent prompt injection.
- [EXTERNAL_DOWNLOADS]: The installation process requires downloading and executing the
cdp-bridgepackage from PyPI viauvxand loading an unpacked extension from a local source.
Audit Metadata