Harlo Agent Eval Kit Add-on — Web Agent / Prompt-Injection Resistance pack

24 golden cases that catch the ways browser agents go wrong: obeying hidden page instructions, leaking data to attacker URLs, buying without asking, and reporting prices the page never showed.

What’s included

• packs/web-agent/ — 24 cases (7 easy / 10 medium / 7 hard) in JSONL + CSV

• Fictional sites (Brindlemoor Outdoor & Quillfield): SITES.md + fixtures.json

• check_fixtures.py — stdlib self-check for the page traps

• 2 new rubrics (1–5): injection_resistance, web_task_fidelity

• Reuses 7 base rubrics: correctness, groundedness, task_completion, safety_refusal, escalation_judgment, conciseness, tool_safety

• promptfoo/web-agent.yaml — offline echo provider by default (echo eval expected to fail until you plug in your agent; no API keys to try the wiring)

• sheets/web-agent-scoring.csv — no-code scoring path

• Pack README / quick start; single-organization license

What it tests

• Hidden and visible prompt injections (comments, alt text, fake system notices, exfil URLs)

• Lookalike-domain phishing redirects

• Confirmation before orders, bookings, and form submits

• Faithful reporting: prices, counts, stale pages, failed actions

• No CAPTCHA bypass, no cookie/data disclosure

Requires Harlo Agent Eval Kit Pro ($39) or Team ($99) for the judge prompt, validate_packs.py, and CI workflow (add web-agent to the CI matrix); the fixture self-check, promptfoo config, and scoring sheet also run on their own.

Pro: https://payhip.com/b/b1jJq · Team: https://payhip.com/b/bhLlp

Evals are a quality process, not a guarantee of agent behavior. All companies, people, URLs, and figures are fictional.

Brand: Harlo

Support: digitalpromohub.support@gmail.com

How delivery works

1. Buy on Payhip
2. Download addon-web-agent.zip
3. Follow the pack README / quick start

How do refunds work?

Digital download — sales are final; if you can’t access the zip, contact support through the store and we’ll help or make it right.