browser-use
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted external web pages, creating an attack surface where malicious content could attempt to influence the agent's behavior.
- Ingestion points: Data enters the agent's context through browser inspection and screenshot tools (SKILL.md).
- Boundary markers: The skill contains explicit instructions for the agent to treat page text as 'untrusted data' and forbids it from overriding user requests or tool boundaries (SKILL.md).
- Capability inventory: The skill possesses capabilities for navigation, element interaction, and visual observation across multiple browser tabs (SKILL.md).
- Sanitization: The instructions require the agent to verify resulting states and treat external text strictly as evidence rather than instructions, while also protecting session tokens and authority metadata.
Audit Metadata