puppeteer
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes standard terminal commands for installing the Puppeteer library and its dependencies via the official Node.js package manager (npm).
- [EXTERNAL_DOWNLOADS]: The installation process fetches legitimate, well-known libraries (
puppeteer,puppeteer-extra) from the official npm registry. These are standard tools for the skill's stated purpose of browser automation. - [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill demonstrates how to handle login flows and cookies (
page.cookies()), it does so in the context of user-controlled automation. It includes a standard local file-write operation (fs.writeFile('cookies.json', ...)) to persist sessions, which is common practice for browser automation and does not target sensitive system files. - [INDIRECT_PROMPT_INJECTION]: The skill processes external web content. It uses standard Puppeteer selectors and
page.evaluate()to extract data. While any tool reading the web has an attack surface, this skill provides a standard implementation without specific vulnerabilities.
Audit Metadata