The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes an evaluate action that allows for the execution of arbitrary JavaScript within the browser's context. When the pageWorld: true parameter is used, the agent gains access to global variables, application state, and internal framework data (e.g., ProseMirror or Lexical internals). This capability can be misused to perform unauthorized actions or steal application-level secrets that are not normally accessible via standard DOM APIs.
[CREDENTIALS_UNSAFE]: The autoLogin action and vault management tools (vaultStatus, vaultSync) enable autonomous access to a user's Bitwarden vault. The skill documentation notes that the vault is automatically unlocked using a master password from the system keyring, allowing the agent to fill and submit credentials without direct human interaction. This presents a high risk of credential exposure or unauthorized account access if the agent is manipulated.
[DATA_EXFILTRATION]: The skill provides tools to capture sensitive information from authenticated browser sessions, including the screenshot action for visual data and getContent for structured page data. Because the browser session retains the user's real logins and cookies, these tools can be used to extract PII, financial information, or session tokens from private accounts.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection (Category 8).
Ingestion points: The getContent and getInteractables actions read arbitrary text and metadata from any website the agent visits (SKILL.md).
Boundary markers: None identified. There are no instructions for the agent to ignore or delimit instructions found within the page content.
Capability inventory: The agent has powerful write capabilities, including clicking, typing, form submission, and arbitrary JavaScript execution (SKILL.md).
Sanitization: None identified. The skill relies on the agent to process raw, untrusted HTML/text to decide its next actions.
[COMMAND_EXECUTION]: The browser CLI tool accepts JSON parameters for actions. If the agent incorporates data retrieved from an untrusted web page into the script parameter of an evaluate call or the text parameter of a type call without sanitization, it could lead to script injection or unintended command execution within the browser environment.

firefox-browser