web-access-claude-skill
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install software from an external, unverified GitHub repository (
github.com/eze-is/web-access) which is not associated with the official vendor. - [COMMAND_EXECUTION]: Installation and operation involve executing local shell scripts (
check-deps.sh) and launching a persistent background Node.js process (cdp-proxy.mjs). - [DYNAMIC_EXECUTION]: The architecture relies on an
/evalHTTP endpoint that executes arbitrary JavaScript strings within the browser context, allowing for unconstrained interaction with web content. - [INDIRECT_PROMPT_INJECTION]: The skill creates a significant vulnerability surface by ingesting raw HTML and page data from arbitrary websites without sanitization or boundary markers.
- Ingestion points: The skill reads
document.documentElement.outerHTMLand text content via the Jina service as described inSKILL.md. - Boundary markers: None are defined to separate untrusted web content from agent instructions.
- Capability inventory: The skill provides high-privilege capabilities including arbitrary JavaScript execution (
/eval), mouse event simulation (/clickAt), and file uploads (/setFiles). - Sanitization: There is no evidence of sanitization or filtering for the data ingested from external URLs.
- [METADATA_POISONING]: There is a discrepancy between the platform-provided author information and the author claimed within the skill body (
ara.so), which may be intended to mislead users about the source of the code.
Recommendations
- AI detected serious security threats
Audit Metadata