Skills
skills/dereknex/skills/agent-browser/Gen Agent Trust Hub

agent-browser

Fail

Audited by Gen Agent Trust Hub on Feb 16, 2026

Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [Indirect Prompt Injection] (HIGH): The skill is highly vulnerable to indirect prompt injection because it ingests untrusted data from the web and possesses powerful write/execute capabilities. \n
  • Ingestion points: agent-browser open, snapshot, get text, and get html in SKILL.md. \n
  • Boundary markers: Absent. \n
  • Capability inventory: Arbitrary JavaScript execution (eval), form manipulation (fill, click), file uploads (upload), and network interception (network route). \n
  • Sanitization: None detected for extracted web content. \n- [Remote Code Execution] (HIGH): The eval command allows for the execution of arbitrary JavaScript within the browser context. This can be abused if the agent is tricked into running malicious code by a website. Evidence: agent-browser eval in SKILL.md. \n- [Data Exfiltration] (HIGH): The skill provides mechanisms to send local data to external sources or expose session secrets. Evidence: agent-browser upload @e1 file.pdf for file exfiltration and agent-browser cookies or agent-browser state save for session data exposure. \n- [Command Execution] (MEDIUM): The skill exposes a wide range of browser control commands including network routing and process-level interaction via CDP. Evidence: agent-browser network route and agent-browser --cdp 9222 in SKILL.md.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Feb 16, 2026, 08:53 AM