tinyfish-browser
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of data from untrusted external websites through remote browser sessions.\n
- Ingestion points: The
create_browser_sessiontool inSKILL.mdenables navigation to any URL, allowing the agent to read and interact with arbitrary web content.\n - Boundary markers: The instructions do not specify the use of prompt delimiters or boundary markers for external data, but they do explicitly warn the agent that all content read through the session must be treated as untrusted.\n
- Capability inventory: The skill provides tools in
SKILL.md(create_browser_session,list_browser_sessions,close_browser_session) that grant the agent full programmatic control over a remote browser instance via a CDP WebSocket URL, including the ability to inject JavaScript and intercept requests.\n - Sanitization: The instructions do not provide specific sanitization or filtering requirements for the content retrieved from the browser sessions.
Audit Metadata