weave-browser

Browser-agent security (Weave Protocol)

The @weave_protocol/browser package enforces WARD.md policies inside browser-based AI agents and detects indirect prompt injection (IPI) in page content. It's the fifth WARD enforcement surface (after MCP, Claude Code, Antigravity, and MSAF).

When to use

• User is building a browser agent with Playwright, Puppeteer, Stagehand, browser-use, or similar
• User's agent fetches and reasons about web content (scraping, research, automation)
• User wants to detect indirect prompt injection (IPI) in pages before ingestion
• User wants navigation gating (which URLs the agent may visit)
• User wants download gating (block executables, scripts, etc.)
• User wants to elevate scrutiny on agent actions taken after ingesting untrusted content

Primary API

import { WardBrowserGuard } from '@weave_protocol/browser';

const guard = new WardBrowserGuard({
  // wardPath: './WARD.md'        // explicit; otherwise auto-resolves
  // ipiSensitivity: 'strict' | 'standard' | 'lenient'   // default: 'standard'
  // failMode: 'open' | 'closed'  // default: 'open'
});

// Four enforcement methods:
await guard.checkNavigation(url, sessionId);         // gate URL fetch
await guard.scanForInjection(html, { url, sessionId, isHtml: true });
await guard.checkDownload({ url, filename, mimeType });
await guard.checkAction(capability, sessionId);      // gate tool calls post-ingestion

// One-line Playwright integration:
guard.wrapPlaywrightPage(page, sessionId);

What it detects

33 IPI patterns across these categories:

• Trigger phrases (9): "ignore previous", role hijack, chat-template tokens
• Action directives (4, critical): send email/payment/exec to X
• Payment specifications (1, critical): recipient + amount in proximity (Atlan autonomous-fraud pattern)
• Hidden CSS content (6): display:none, visibility:hidden, white-on-white (Brave/Comet pattern), off-screen
• HTML injection (5): comments, noscript, aria-hidden, meta tags, alt text
• Encoding obfuscation (3): base64, Unicode zero-width, data:text/html
• Tool-call mimicry (2): JSON or XML resembling LLM tool calls
• DoS / suppression (2): false copyright claims, "do not summarize"
• SVG + script (1): XSS+IPI combination