agent-browser
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted web content, which presents a potential attack surface for indirect prompt injection. It proactively addresses this with extensive security instructions for the agent.
- Ingestion points: Browser snapshots, element text, console messages, and network response bodies entering via CLI commands as documented in "references/trust-boundaries.md" and "references/upstream-core.md".
- Boundary markers: The instructions in "SKILL.md" and "references/trust-boundaries.md" explicitly define web content as untrusted data and provide examples of injection attempts (e.g., 'ignore previous instructions') that the agent must flag and ignore.
- Capability inventory: The "agent-browser" CLI used by the skill can perform file operations, network requests, and browser interactions.
- Sanitization: The skill mandates that the agent does not follow instructions found within the browser context and restricts browser navigation to user-authorized domains.
- [DATA_EXPOSURE]: The skill provides best practices for secret management, recommending the use of an authentication vault, environment variables, or secure file imports to avoid hardcoding credentials or exposing them in command logs.
- [EXTERNAL_DOWNLOADS]: The skill references the official "agent-browser" package and documentation hosted on the project's GitHub repository and official website.
Audit Metadata