The Agent Skills Directory

[DATA_EXFILTRATION]: The skill includes a script, find-url.mjs, that directly accesses and queries sensitive browser data files, such as history and bookmarks, for Chromium-based browsers like Chrome and Microsoft Edge. This exposes detailed browsing habits and information contained within URLs to the agent. Additionally, the CDP proxy provides a /setFiles endpoint that allows the agent to programmatically select and upload local files to websites.\n- [COMMAND_EXECUTION]: The skill executes local system commands like sqlite3 to query browser databases and uses node to manage a persistent background process (cdp-proxy.mjs) for browser communication. It also utilizes pkill to manage proxy lifecycle.\n- [REMOTE_CODE_EXECUTION]: The CDP proxy provides an /eval endpoint that enables the agent to execute arbitrary JavaScript within the user's active browser session. This grants the agent deep control over the web pages it visits, including the ability to manipulate the DOM, trigger actions, and bypass standard UI interactions.\n- [PROMPT_INJECTION]: As the skill is designed to navigate and extract data from arbitrary web pages, it is highly susceptible to indirect prompt injection. Malicious websites could host hidden instructions designed to exploit the agent's extensive browser permissions or exfiltrate sensitive data gathered from the user's local environment.\n
Ingestion points: Untrusted web content retrieved via JavaScript execution in the browser, screenshots of external pages, and content processed via the Jina service.\n
Boundary markers: The skill instructions do not define specific delimiters or security headers to help the agent distinguish between its core logic and potentially adversarial content found on the web.\n
Capability inventory: Access to local browser history and bookmarks, arbitrary JavaScript execution in browser tabs, file upload capabilities, and general network access.\n
Sanitization: There is no evidence of filtering or validation of external web content before it is processed by the agent.

web-access