The Agent Skills Directory

Remote Code Execution (CRITICAL): The SKILL.md file instructs users to execute a remote script using 'curl -fsSL https://cli.inference.sh | sh'. This executes unverified code from an untrusted source (inference.sh), which is a high-severity attack vector.
External Downloads (MEDIUM): The skill relies on scripts and tools downloaded from 'inference.sh', which is not included in the list of trusted external organizations.
Command Execution (HIGH): The skill requests the 'Bash(infsh *)' tool in its allowed-tools list. This grants the agent broad shell execution privileges, which could be exploited for host compromise if the agent's instructions are manipulated.
Indirect Prompt Injection (LOW): The skill represents a significant surface for indirect prompt injection as it ingests untrusted data from the web. Evidence: (1) Ingestion points: Untrusted web content and element descriptions are ingested via 'open', 'snapshot', and 'execute' functions in SKILL.md and references/commands.md. (2) Boundary markers: Absent; there are no delimiters or protective instructions telling the agent to ignore embedded instructions in the web data. (3) Capability inventory: High; the skill can 'interact' (fill, click), 'execute' JavaScript, and 'upload' files. (4) Sanitization: No evidence of sanitization or filtering of the retrieved web content is provided.
Dynamic Execution (MEDIUM): The 'execute' function allows for the execution of arbitrary JavaScript code on the target page. While intended for automation, it could be used to exfiltrate session data or cookies if a malicious prompt is processed.

agent-browser