The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill is designed to navigate to and process untrusted external content, creating a major vulnerability surface.
Ingestion points: Untrusted data enters the agent context through agent-browser open <url> and agent-browser snapshot, which retrieves DOM and accessibility tree information (SKILL.md).
Boundary markers: The documentation does not specify any delimiters or instructions for the agent to ignore content found within the browser context.
Capability inventory: The skill possesses significant 'write' and 'execute' capabilities including fill, click, press, and select, allowing it to perform state-changing actions on websites on behalf of the user.
Sanitization: There is no mention of sanitizing retrieved web content or filtering out executable scripts/instructions before they are processed by the agent.
Data Exposure & Exfiltration (HIGH): The navigation and data extraction commands can be used to target sensitive local or internal data.
[Category 2] (HIGH): The agent-browser open <url> command does not restrict protocol schemes. An attacker could potentially use file:// to read local system files (e.g., ~/.ssh/id_rsa or /etc/passwd) or http://localhost to probe internal services.
[Category 2] (HIGH): Commands like agent-browser get text, agent-browser get value, and agent-browser screenshot allow for the extraction of sensitive information from pages, which the agent can then be manipulated into exfiltrating.

agent-browser