agent-browser
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation explicitly describes the capability to inject and execute custom JavaScript within the browser's console to extract data or simulate user behavior.
- [COMMAND_EXECUTION]: The installation process involves executing code from a remote registry via the shell command
npx clawhub@latest install agent-browser. - [DATA_EXFILTRATION]: The skill can monitor and intercept network requests (XHR/Fetch), access browser session data (cookies, localStorage), and export screenshots, videos, or PDFs, which provides a path for harvesting sensitive information.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted data from websites while possessing high-privilege capabilities:
- Ingestion points: Web content accessed via tools such as
navigate,snapshot, and network request monitoring described inSKILL.md. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between its instructions and embedded commands within the processed web pages.
- Capability inventory: Includes direct element interaction (clicking, typing), custom script execution (console injection), and session persistence.
- Sanitization: There is no evidence of sanitization or validation of the ingested web content before the agent performs actions based on that data.
Audit Metadata