puppeteer-skill
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface inherent to its function as a web scraper.
- Ingestion points: The skill uses
page.gototo navigate to and process content from external URLs. - Boundary markers: None identified in the provided templates.
- Capability inventory: The skill can execute browser-side logic via
page.evaluateand perform interactions likepage.clickandpage.type. - Sanitization: No sanitization is implemented for external content within the provided examples.
- [DATA_EXFILTRATION]: The skill includes patterns for connecting to LambdaTest's cloud browser grid.
- Evidence: Connection to
wss://cdp.lambdatest.com/puppeteerfor remote browser control. - Context: This is a standard connection to a well-known service for cross-browser testing.
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling for its cloud integration.
- Evidence: Use of
process.env.LT_USERNAMEandprocess.env.LT_ACCESS_KEY. - Context: Storing sensitive keys in environment variables is a recommended security practice.
Audit Metadata