The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the open web, creating an attack surface for indirect prompt injection where malicious instructions embedded in a website could influence the agent's behavior.
Ingestion points: The agent receives external data through extract_page (which returns visible text or HTML), list_accounts (listing saved login identifiers), and list_downloads (returning filenames from the browser).
Boundary markers: The documentation does not specify the use of delimiters or explicit boundary instructions to prevent the agent from following natural language commands found within extracted page content.
Capability inventory: The skill grants the agent high-level capabilities, including browser automation (run_steps), file uploads (upload_file), and file downloads (download_file).
Sanitization: Although extract_page and status are described as returning "sanitized" or "capped" content, there is no detailed mechanism provided to sanitize against adversarial instructions embedded in web content.
[COMMAND_EXECUTION]: The run_steps action allows the agent to execute a sequence of browser automation commands (e.g., goto, click, fill, type_text) using the user's authenticated sessions. While the grammar is restricted and JavaScript injection is explicitly blocked, these commands enable the agent to interact with and modify state in sensitive external web applications such as CRMs, ERPs, and social media platforms.

astrobrowse-authenticated-agentic-browser