agent-browser
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the web, creating a surface for indirect prompt injection.
- Ingestion points: Browser navigation via
agent-browser open(SKILL.md). - Boundary markers: The skill documents and recommends the use of
AGENT_BROWSER_CONTENT_BOUNDARIESto wrap page output in nonces, helping the agent distinguish tool results from untrusted page content. - Capability inventory: The skill allows clicking, form filling, JavaScript execution (
eval), and file downloads (download). - Sanitization: The platform provides a specific environment variable
AGENT_BROWSER_CONTENT_BOUNDARIESto handle content isolation. - [DYNAMIC_EXECUTION]: The
agent-browser evalcommand allows for the execution of arbitrary JavaScript within the browser context. While this is a primary feature of the skill, it allows the agent to run complex logic, including base64-encoded scripts to bypass shell escaping issues. - [COMMAND_EXECUTION]: The skill facilitates broad interaction with the local environment, including opening local files via
file://URIs (gated by the--allow-file-accessflag) and managing session state files that store cookies and localStorage data.
Audit Metadata