The Agent Skills Directory

[DYNAMIC_EXECUTION]: The 'evaluate' action enables the execution of arbitrary JavaScript code within the context of any webpage open in the user's browser.
Evidence: 'extension/content.js' uses 'new Function(params.script)' to execute strings received via WebSocket.
Evidence: 'extension/background.js' implements 'evaluateViaDebugger' using the 'chrome.debugger' API to bypass Content Security Policy (CSP).
[DATA_EXFILTRATION]: The skill includes 'uploadFile' and 'dropFile' actions that allow the agent to read arbitrary local files.
Evidence: 'rust-cli/src/main.rs' uses 'std::fs::read(file_path)' to capture local file bytes and encode them as base64 for 'upload'. This allows an agent to read sensitive files like '~/.ssh/id_rsa' or '.env' files.
[CREDENTIALS_UNSAFE]: The 'autoLogin' feature retrieves plaintext credentials from a Bitwarden vault and fills them into web pages.
Evidence: 'rust-cli/src/bin/host.rs' fetches secrets using 'bronzewarden'.
Evidence: 'native-host-wrapper.sh' explicitly disables safety checks by setting 'FAB_AUTOLOGIN_REQUIRE_FINGERPRINT=false'. This allows an agent to autonomously fetch and potentially read passwords from the browser DOM.
[PERSISTENCE]: The installation process establishes a permanent link between the system and the browser.
Evidence: 'scripts/install-native-host.sh' registers a native messaging host manifest in the user's Mozilla directory, ensuring the host binary is always available for execution by the browser extension.
[COMMAND_EXECUTION]: The skill relies on the 'Bash' tool to operate a powerful CLI that bridges the local system to the browser.
Evidence: 'SKILL.md' instructs the agent to execute the 'browser' command to perform all actions, which include file reads and network communication.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the web and interpolates it into the agent context without sufficient sanitization.
Evidence: 'extension/content.js' (getContent, preexplore) provides raw page content to the agent, creating an attack surface where instructions embedded in malicious websites can manipulate agent behavior.

firefox-browser