weave-browser — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited weave-browser (Agent Skill) and scored it 65/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 5 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 5 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The @weave_protocol/browser package enforces WARD.md policies inside browser-based AI agents and detects indirect prompt injection (IPI) in page content. It's the fifth WARD enforcement surface (after MCP, Claude Code, Antigravity, and MSAF).
import { WardBrowserGuard } from '@weave_protocol/browser';
const guard = new WardBrowserGuard({
// wardPath: './WARD.md' // explicit; otherwise auto-resolves
// ipiSensitivity: 'strict' | 'standard' | 'lenient' // default: 'standard'
// failMode: 'open' | 'closed' // default: 'open'
});
// Four enforcement methods:
await guard.checkNavigation(url, sessionId); // gate URL fetch
await guard.scanForInjection(html, { url, sessionId, isHtml: true });
await guard.checkDownload({ url, filename, mimeType });
await guard.checkAction(capability, sessionId); // gate tool calls post-ingestion
// One-line Playwright integration:
guard.wrapPlaywrightPage(page, sessionId);33 IPI patterns across these categories:
| Situation | Action |
|---|---|
| User has a Playwright agent | Show guard.wrapPlaywrightPage(page, sessionId) one-liner |
| User has a Puppeteer or Stagehand agent | Show the manual hook pattern from README |
| User wants to block specific URLs | WARD ## Network deny rule + checkNavigation |
| User wants to detect IPI | scanForInjection — pure detection, no LLM in the loop |
| User worried about agent being tricked into exfiltrating data | Use checkAction after ingestion — tainted sessions require approval |
| User worried about malicious downloads | checkDownload with custom blockedExtensions / blockedMimeTypes |
| User wants to dry-run | weave-browser test-url <url> or weave-browser scan <file-or-url> |
| User has high false-positive tolerance | ipiSensitivity: 'strict' |
| User has low false-positive tolerance | ipiSensitivity: 'lenient' (only critical blocks) |
weave-browser init [--framework=playwright|puppeteer|stagehand]
weave-browser status
weave-browser test-url <url>
weave-browser scan <file-or-url>WardBrowserDeniedError — navigation, download, or action denied by policyIpiDetectedError — IPI detected at the sensitivity threshold (carries the full scan result)@weave_protocol/ward — the policy format being enforced@weave_protocol/mund — threat scanner (could feed updated patterns to the browser scanner)@weave_protocol/hundredmen — MCP-layer enforcement (complementary)checkAction to gate tool calls in tainted sessions.hidden_text_color patterntrigger_phrase + tainted action gatingtrigger_phrase in product listingspayment_specification patterndenial_of_service patternIf a user reports their agent did something unexpected after browsing a page, the first diagnostic is weave-browser scan <url> against that page.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.