The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the web, creating a significant attack surface for indirect prompt injection. Malicious instructions embedded in a web page could attempt to manipulate the agent into using its browser interaction tools for unauthorized actions.
Ingestion points: Web page content and interactive element descriptions are ingested via the open and snapshot functions (seen in SKILL.md and templates/capture-workflow.sh).
Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are provided in the interaction templates.
Capability inventory: The skill allows for high-impact actions including JavaScript execution (execute), file uploads (upload), and credential entry (fill).
Sanitization: The skill does not demonstrate any sanitization or validation of the processed DOM content before it is presented to the agent.
[DYNAMIC_EXECUTION]: The execute function allows the agent to run arbitrary JavaScript code within the target browser's context. This capability is documented as a feature for data extraction and page manipulation but could be abused to harvest sensitive data like cookies, local storage, or session tokens.
Evidence: The execute function is defined in references/commands.md and demonstrated as a core feature in SKILL.md and templates/capture-workflow.sh.
[DATA_EXFILTRATION]: The interact function's upload action accepts an array of local file_paths. This allows an agent to read local files and send them to the browser environment. If the agent is influenced by malicious web content, it could be tricked into exfiltrating sensitive local files (e.g., .env, .ssh/id_rsa) to a remote site.
Evidence: The upload action is documented in references/commands.md and the interaction flow is described in SKILL.md.

agent-browser