The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes an execute function that allows the execution of arbitrary JavaScript code within the browser context, as documented in SKILL.md and references/commands.md.
[DATA_EXFILTRATION]: The skill provides mechanisms to extract browser cookies via JavaScript execution and to upload local files to remote web forms using the interact function's upload action. These capabilities allow the agent to access and transmit sensitive local and session data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web, creating an attack surface for indirect prompt injection where malicious site content could influence agent behavior.
Ingestion points: Web content is ingested via the open, snapshot, and execute functions described in SKILL.md and references/commands.md.
Boundary markers: The skill does not document the use of delimiters, structured data enforcement, or instructions to help the agent distinguish between data and potentially malicious instructions embedded in web content.
Capability inventory: The skill possesses high-privilege capabilities including JavaScript execution (execute), arbitrary file uploading (interact), and full network navigation (open).
Sanitization: No sanitization or validation of ingested web content is performed before it is passed to the agent's context.
[COMMAND_EXECUTION]: The skill's operation and templates (e.g., templates/authenticated-session.sh) rely on the execution of the belt and infsh CLI tools via shell commands to interact with the browser automation service.
[EXTERNAL_DOWNLOADS]: The skill documentation in SKILL.md instructs users to install an external package, belt-sh/cli, using npx to enable the browser automation functionality.

agent-browser