potion-yjs-dev-browser-test
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to dynamically generate and execute shell scripts using the
dev-browserutility to control a persistent Chrome instance. - Evidence: "For each new case, write a small one-off
dev-browser --connect http://127.0.0.1:9222 <<'EOF'script from the current repro steps." - [PROMPT_INJECTION]: The skill reads and processes content from external web pages (Potion documents), creating a surface for indirect prompt injection where malicious content in a document could influence the agent's behavior during a test session.
- Ingestion points: Browser pages accessed via
browser.getPageand document state reading using selectors like[data-slate-editor="true"](SKILL.md). - Boundary markers: None observed; the instructions do not specify delimiters or warnings to ignore embedded instructions in the ingested document content.
- Capability inventory: Shell script execution via
dev-browser, network condition manipulation via Chrome DevTools Protocol (CDP). - Sanitization: No sanitization or validation of external content is specified before the agent processes the document state.
Audit Metadata