use-browser
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill features a 'user-browser' mode specifically designed to interact with the user's real browser state. This includes access to live cookies, authentication tokens, extensions, and local storage. This capability creates a high risk of sensitive session data being exposed through screenshots, DOM snapshots, or agent logs, especially since the skill explicitly encourages screenshots as a primary practice.
- [PROMPT_INJECTION]: The skill allows the agent to navigate and process arbitrary external websites, introducing a surface for indirect prompt injection where malicious content on a page could influence the agent's behavior.
- Ingestion points: External web content retrieved via
page.content(), DOM inspection, and visual screenshots. - Boundary markers: No specific delimiters or safety instructions are defined to separate untrusted site content from the agent's internal logic.
- Capability inventory: The agent can execute Node.js scripts (
node -e), perform shell commands (npx playwright codegen), and capture file system data (screenshots). - Sanitization: The instructions do not specify any validation or sanitization of content scraped from the browser before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill's workflow involves executing shell commands and dynamically generated Node.js scripts to control the Playwright browser instance.
Audit Metadata