browserskill-release-test
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
release_audit.pyscript executes a local BrowserSkill binary to perform automated browser testing. The commands and arguments are derived from test plans, and the process is managed using Python'ssubprocessmodule without shell expansion. - [EXTERNAL_DOWNLOADS]: The skill benchmark tasks involve visiting and extracting data from well-known domains like GitHub, Bilibili, and Taobao. These operations are intended for auditing the tool's performance on real-world websites.
- [INDIRECT_PROMPT_INJECTION]: The skill explicitly tests for indirect prompt injection resilience. It includes HTML fixtures with hidden text, transparent layers, and subpixel font-size blocks (steganography) to verify that the auditing process can effectively identify and strip non-visible instructions.
- [DYNAMIC_EXECUTION]: The skill uses a local server (
serve.py) to host test fixtures on the loopback address and dynamically generates test results and benchmarking metrics based on runtime execution data.
Audit Metadata