The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a CLI and MCP interface for executing arbitrary Node.js code on the host machine.\n
Evidence: The browser-control execute command allows running scripts either passed as a string or from a file.\n
Access: The execution environment has access to core Node.js modules like fs and path, enabling the agent to read and write files on the local system (e.g., saving downloaded private keys).\n- [DYNAMIC_EXECUTION]: The skill's primary function is to interpret and run JavaScript/Playwright code at runtime.\n
Evidence: Multiple examples show passing raw code strings to the execute command for browser interaction.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection by processing untrusted web content and allowing web pages to define tools.\n
Ingestion points: SKILL.md describes tools like snapshot(), ariaSnapshot(), and webmcp.list() which read data directly from the DOM of external websites (e.g., browser-control execute returning page content).\n
Boundary markers: The skill does not describe any specific delimiters or instructions to the agent to ignore content within the browser snapshots, making it vulnerable to instructions embedded in web pages.\n
Capability inventory: The agent has access to full browser control (clicking, typing, navigation), local filesystem access via fs, and network capture capabilities.\n
Sanitization: There is no mention of sanitization for content retrieved from the web before it is processed by the agent or passed to the webmcp tool caller.\n- [DATA_EXFILTRATION]: The skill can capture sensitive browser data and save it to the local disk.\n
Evidence: The network start and network stop commands allow capturing authenticated network flows into HAR files. The download event handler allows saving browser downloads (including example private keys) to arbitrary local paths.

browser-control