The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/mcp-client.py uses subprocess.Popen with shell=True in the StdioTransport class to launch local MCP servers. While this is a common pattern for starting command-line tools provided by users (such as via the --stdio argument), the use of shell=True is generally discouraged due to potential command injection risks if inputs are not properly sanitized.
[DYNAMIC_EXECUTION]: The skill includes tools browser_evaluate and browser_run_code that execute arbitrary JavaScript strings within the browser context. This is a core feature for complex browser automation but represents a dynamic execution vector that could be exploited if an agent is directed to execute malicious code.
[INDIRECT_PROMPT_INJECTION]: As a browser automation tool, the skill is inherently susceptible to indirect prompt injection.
Ingestion points: The agent ingests untrusted data from the web through browser_snapshot (accessibility tree) and browser_evaluate (DOM content).
Boundary markers: The instructions do not define clear boundaries or warnings for the agent to ignore instructions embedded in web content.
Capability inventory: The skill possesses significant capabilities, including the ability to write files (screenshots), upload local files via absolute paths (browser_file_upload), and execute shell commands via the included scripts.
Sanitization: There is no evidence of sanitization or filtering applied to the web content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The documentation in SKILL.md and scripts/start-server.sh recommends installing the Playwright MCP server using npx @playwright/mcp@latest. This fetches and executes code from the official npm registry for the Playwright project, which is a well-known and trusted service.

browser-use