anything-analyzer-cdp
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone and install dependencies from an external, untrusted GitHub repository (https://github.com/MouseWW/anything-analyzer.git).\n- [INDIRECT_PROMPT_INJECTION]: The prompt construction in
src/main/ai/prompt-builder.tsis vulnerable to indirect prompt injection because it directly interpolates untrusted browser data into the LLM context.\n - Ingestion points: The skill captures network request headers, bodies, JavaScript hook events, and storage snapshots from external websites visited in the embedded browser.\n
- Boundary markers: The prompt construction lacks clear delimiters or specific instructions to the LLM to ignore potentially malicious commands embedded in the captured data.\n
- Capability inventory: The application captures full network traffic, reads storage contents, and transmits this data to external AI APIs for processing.\n
- Sanitization: Captured data is passed through
JSON.stringifybut no additional filtering, escaping, or validation is applied to prevent adversarial input from influencing the AI output.\n- [DATA_EXFILTRATION]: The skill describes an application designed to capture highly sensitive information, including authentication headers, cookies, and session storage. This data is then sent to external LLM providers (OpenAI, Anthropic, or custom endpoints) for analysis, creating a potential exposure surface for credentials.\n- [DYNAMIC_EXECUTION]: The installation process involves compiling native code for thebetter-sqlite3library (pnpm rebuild). Furthermore, the tool uses the Chrome DevTools Protocol (Page.addScriptToEvaluateOnNewDocument) to dynamically inject custom JavaScript hooks into the context of every web page loaded in the analyzer's browser.
Audit Metadata