crawlberg-automating-the-browser
Warn
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
crawlberg interactcommand-line utility to control a headless browser through a series of JSON-defined actions. - [DYNAMIC_EXECUTION]: The
executeJsaction type allows for the execution of arbitrary JavaScript code within the context of the loaded web page. While the documentation advises using only "trusted scripts," this feature enables dynamic code execution at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to fetch and interact with content from external URLs. This creates an attack surface where a malicious website could include instructions intended to manipulate the agent's logic once the content is scraped.
- Ingestion points: Web page content retrieved via
crawlberg interact <url>. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided in the skill text.
- Capability inventory: Browser automation (click, type, press), arbitrary JavaScript execution (
executeJs), and HTML scraping. - Sanitization: The skill does not explicitly mention sanitization or validation of the content retrieved from the browser before the agent processes it.
Audit Metadata