puppeteer-skill

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface inherent to its function as a web scraper.
  • Ingestion points: The skill uses page.goto to navigate to and process content from external URLs.
  • Boundary markers: None identified in the provided templates.
  • Capability inventory: The skill can execute browser-side logic via page.evaluate and perform interactions like page.click and page.type.
  • Sanitization: No sanitization is implemented for external content within the provided examples.
  • [DATA_EXFILTRATION]: The skill includes patterns for connecting to LambdaTest's cloud browser grid.
  • Evidence: Connection to wss://cdp.lambdatest.com/puppeteer for remote browser control.
  • Context: This is a standard connection to a well-known service for cross-browser testing.
  • [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling for its cloud integration.
  • Evidence: Use of process.env.LT_USERNAME and process.env.LT_ACCESS_KEY.
  • Context: Storing sensitive keys in environment variables is a recommended security practice.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 09:36 AM
Security Audit — agent-trust-hub — puppeteer-skill