The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it is designed to ingest and process content from arbitrary URLs. Malicious instructions embedded in web pages could mislead the agent into performing unintended actions or exfiltrating data. The skill documents a mitigation using --content-boundaries to help the agent distinguish tool output from page content.
[DYNAMIC_EXECUTION]: The eval command allows the execution of arbitrary JavaScript within the browser context. This is a core functionality but represents a high-risk capability that could be exploited if the agent is directed to run malicious scripts by an untrusted source.
[OBFUSCATION]: The eval command supports a -b (base64) flag and --stdin mode. While intended to resolve shell escaping issues, these features allow the execution of JavaScript that is not visible in plain text in logs or command history, facilitating the concealment of malicious intent.
[DATA_EXFILTRATION]: The --allow-file-access flag enables the agent to open and read local files (e.g., file:///path/to/sensitive/file) into its context. When combined with the skill's ability to interact with web forms and perform network operations, this creates a potential path for local data exposure and exfiltration.
[CREDENTIALS_UNSAFE]: The skill includes credential management features like auth save and session state persistence (state save). Although it recommends security best practices such as using an encrypted vault and excluding state files from version control, these files remain high-value targets for credential harvesting.

agent-browser