browser-testing-with-devtools
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides configuration instructions to run
npx -y chrome-devtools-mcp@latest --isolated. This command downloads and executes code from the npm registry, introducing a third-party dependency into the agent's environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from active browser sessions, creating a vulnerability to indirect prompt injection from malicious websites.\n - Ingestion points: live DOM tree, console logs, network requests, and JavaScript execution results (referenced in SKILL.md).\n
- Boundary markers: The skill provides instructions for the agent to maintain clear boundaries between trusted user instructions and untrusted browser data, though no specific technical delimiters are enforced in the provided snippets.\n
- Capability inventory: The agent can navigate to URLs, take screenshots, execute JavaScript in the page context, and monitor network traffic.\n
- Sanitization: The skill explicitly instructs the agent to treat browser content as untrusted data, to never interpret it as instructions, and to verify findings with the user before acting on them.\n- [DYNAMIC_EXECUTION]: The skill includes a 'JavaScript Execution' tool to run code within the page context. Although the instructions include constraints (e.g., read-only by default, no external requests), this capability allows for dynamic code execution on remote content.
Audit Metadata