agent-browser
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the browsing of external websites and the extraction of page content, which is then processed by the agent. This represents a vulnerability surface where malicious web content could attempt to influence the agent's behavior.
- Ingestion points: Untrusted data enters the context through
agent-browser open <url>and data extraction commands likeagent-browser get text. - Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the extracted data.
- Capability inventory: The skill allows network access (via the browser), file writes (
screenshot,pdf,state save), and local file reads (via--allow-file-access). - Sanitization: There is no evidence of sanitization or filtering of the extracted web content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill operates by executing the
agent-browserCLI tool through the Bash tool provided by the environment. - [EXTERNAL_DOWNLOADS]: The documentation references the installation of the
appiumpackage andxcuitestdrivers from the npm registry to support mobile browser automation.
Audit Metadata