browserpilot-executor
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides a
POST /evaluateendpoint that allows for the execution of arbitrary JavaScript code within the automated browser session. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and extract data from external, untrusted websites, creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context via the
semantic-tree,extract,page-text, andpage-contentendpoints (SKILL.md). - Boundary markers: No specific delimiters or instructions are provided to help the agent distinguish between its core instructions and content retrieved from web pages.
- Capability inventory: The skill possesses extensive capabilities including web navigation, clicking, typing, data extraction, and JavaScript execution via
POST /evaluate. - Sanitization: The instructions do not describe any mechanisms for sanitizing or filtering data extracted from external websites before it is processed by the agent.
- [DATA_EXFILTRATION]: The skill contains commands to extract data from the browser, including text content, input values, and full-page screenshots via the
POST /screenshotandPOST /extractendpoints, which could be used to harvest information from sensitive websites.
Audit Metadata