The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The evaluate action (found in SKILL.md and implemented in extension/content.js) allows the AI agent to execute arbitrary JavaScript code within the context of any browser tab. This provides a direct mechanism to bypass browser security controls, manipulate page logic, or extract data beyond the scope of standard UI interactions.
[DATA_EXFILTRATION]: The uploadFile and dropFile actions (defined in SKILL.md and implemented in rust-cli/src/main.rs) enable the AI agent to read arbitrary files from the local filesystem by providing a local path. This capability presents a high risk of sensitive data exposure, such as SSH keys, configuration files, or private documents, if the agent is misdirected.
[CREDENTIALS_UNSAFE]: The autoLogin feature (SKILL.md, rust-cli/src/bin/host.rs) integrates with the user's Bitwarden vault via the bronzewarden library. While it includes an optional fingerprint verification step (fprintd-verify), it fundamentally allows an AI agent to autonomously access and utilize stored credentials for authentication on any website.
[COMMAND_EXECUTION]: The native messaging host (rust-cli/src/bin/host.rs) executes local system commands including notify-send for desktop alerts and fprintd-verify for biometric authentication.
[PROMPT_INJECTION]: The skill processes untrusted web content via the getContent action (SKILL.md). This establishes a large attack surface for indirect prompt injection, where malicious instructions embedded in a website could manipulate the agent to abuse its powerful browser control, vault access, or file system capabilities.
Ingestion points: getContent action (SKILL.md) reads raw web content into the agent context.
Boundary markers: Absent; the skill does not wrap content in delimiters or provide ignore-instructions warnings.
Capability inventory: evaluate (JS execution), autoLogin (vault access), uploadFile (file read), and various browser interactions (click, type, fillForm).
Sanitization: Absent; raw content is returned to the agent without filtering.
[EXTERNAL_DOWNLOADS]: The skill's Rust component (Cargo.toml) depends on the bronzewarden library hosted at https://github.com/1jehuang/bronzewarden.git. Documentation also directs users to download signed browser extensions (XPI files) from GitHub Releases.

firefox-browser