dev-browser
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Chromium browser during its initialization process via the
playwright installcommand. This represents a download from a well-known service (Microsoft Playwright).\n- [COMMAND_EXECUTION]: The skill requires the execution of shell commands to manage the browser server and relay, as well as running complex TypeScript scripts that control browser automation.\n- [INDIRECT_PROMPT_INJECTION]: Because the skill interacts with arbitrary external websites, it possesses an inherent attack surface for indirect prompt injection. A malicious website could attempt to influence the agent's logic through embedded content.\n - Ingestion points: Web page content retrieved via Playwright navigation and element evaluation in
src/client.ts.\n - Boundary markers: No specific delimiters or instructions to ignore embedded content were identified in the provided code.\n
- Capability inventory: The skill allows for navigation, element interaction, screenshot capture, and network interception.\n
- Sanitization: The skill does not appear to perform specialized sanitization on web content before passing it to the agent's context.\n- [DYNAMIC_EXECUTION]: The skill uses
eval()within the browser context to inject its element discovery and snapshotting logic insrc/client.ts. This is an internal mechanism for interpreting the page structure.\n- [PRIVILEGE_ESCALATION]: In 'Extension Mode', the skill bridges the agent to the user's active browser session, granting it access to existing authentication states and sensitive user data on any website the user is currently logged into.
Audit Metadata