rjv-agent-browser-notes
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous snippets designed to execute arbitrary JavaScript within a target browser session via a CLI tool. These scripts allow an agent to bypass standard UI event handlers, manipulate DOM properties directly, and monkey-patch native browser APIs like XMLHttpRequest to capture data.
- [INDIRECT_PROMPT_INJECTION]: The skill describes methods for reading and analyzing untrusted content from the browser environment, which presents a vulnerability surface where malicious web content could attempt to influence the agent.
- Ingestion points: Browser DOM queries, toast notification text, and intercepted network response bodies (documented in Section 6).
- Boundary markers: Absent; the instructions do not include mechanisms to distinguish between application data and potential instructions embedded within the processed web content.
- Capability inventory: The agent possesses powerful browser interaction capabilities, including arbitrary script execution (eval), input simulation (mouse, press), and session management.
- Sanitization: None; the provided snippets capture and process raw string data (e.g., textContent, responseText) without filtering or escaping.
Audit Metadata