agent-browser-core
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
agent-browserCLI via Bash to perform page navigation, element interaction, and data extraction. - [COMMAND_EXECUTION]: Supports the execution of arbitrary JavaScript within the browser context using the
eval --stdincommand, which is a standard feature for advanced browser automation. - [DATA_EXFILTRATION]: Accesses the local configuration file at
~/.agent-browser/config.jsonto manage browser profiles and executable paths. - [DATA_EXFILTRATION]: Interacts with real browser profiles (Brave, Chrome) to leverage existing authentication states, which involves handling session cookies and profile data.
- [PROMPT_INJECTION]: The skill processes untrusted web content through
snapshotandgetoperations, creating a surface for indirect prompt injection. - Ingestion points: Web page content accessed via
snapshot,get text, andget attrcommands inSKILL.md. - Boundary markers: No specific boundary markers are defined to isolate untrusted web data from the agent's instructions.
- Capability inventory: Extensive browser control capabilities including clicking, form filling, and JavaScript execution are present across the skill's operations.
- Sanitization: No explicit sanitization or filtering of ingested web content is described in the workflow.
Audit Metadata