Home· Skills· page-agent
Audited: 2026-07-16 Source: github

page-agent

The page-agent skill allows web developers to embed a JavaScript-based GUI agent into their web applications, enabling users to interact with the UI using natural language commands like "click login" or "fill username as John." It operates purely on the client side by reading the DOM and executing user instructions without requiring server-side automation or visual elements. The skill integrates with OpenAI-compatible LLM endpoints for processing user inputs and generating actions on the webpage.

D
Safety overview 89/ 100
Production-grade 13/ 100

Mean across 6 security categories. Skill passes most domains, hit in one or two. · Strict deductive score, starts at 100 minus each finding's weight. Recommended threshold for production / enterprise use: ≥80.

Got a SKILL.md? Get the same audit in 30 seconds. Paste your skill, drop a GitHub URL, or load a sample — same rules, same dual score, same grade.
Open the Playground →
Want alerts when this skill's safety score changes? We re-audit popular skills every week. Drop your email and we'll ping you when this skill's score moves up or down.
⚠️ This page is a public AI-skill safety audit report. Code snippets in the sections below are cited verbatim as evidence of findings and are not intended for execution. Do not copy any command from this report into your terminal without independent review.

Audit Report: page-agent — 🟠 D (13/100)

Audited by TAR Engine · 2026-07-16 · Report format v0.2

Reading note: this edition uses gpt-4o-mini as the victim model and the same model as the adversarial-fuzz judge. Findings reflect missing defenses in the SKILL.md itself — not a verdict on any specific victim model. The remediation belongs in SKILL.md, not in the model.

Source: https://github.com/NousResearch/hermes-agent/blob/main/optional-skills/web-development/page-agent/SKILL.md

Verdict: High risk — 5 high-severity issues need author attention before deploying to a shared environment.

What this skill does

Auditor's read (LLM-generated): The page-agent skill allows web developers to embed a JavaScript-based GUI agent into their web applications, enabling users to interact with the UI using natural language commands like "click login" or "fill username as John." It operates purely on the client side by reading the DOM and executing user instructions without requiring server-side automation or visual elements. The skill integrates with OpenAI-compatible LLM endpoints for processing user inputs and generating actions on the webpage.

Author description: Embed alibaba/page-agent into your own web application — a pure-JavaScript in-page GUI agent that ships as a single