The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/eval.py serves as an "escape hatch" that allows the agent to execute arbitrary JavaScript code within the active browser tab. This facilitates complex interactions but also provides a vector for executing potentially malicious scripts if the input is influenced by untrusted sources.
[DYNAMIC_EXECUTION]: The script scripts/upload.py uses the __import__ function to dynamically load the nodriver module, and lib/runner.py dynamically manages the Chromium process life cycle.
[DATA_EXFILTRATION]: The scripts/upload.py utility allows the agent to select local files and upload them to the browser via CDP. If the agent is compromised by indirect prompt injection from a malicious website, this tool could be abused to exfiltrate sensitive local files to an attacker-controlled domain.
[COMMAND_EXECUTION]: The lib/runner.py library executes system commands including ps and lsof to manage the browser daemon and verify process status. It also spawns the Chromium binary using subprocess.Popen. While these commands are invoked with list-based arguments and generally lack shell execution risks, they represent significant system interaction capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and render arbitrary content from the web through scripts/nav.py and scripts/snapshot.py, which is then processed by the agent. This creates a surface for indirect prompt injection attacks where malicious web content could attempt to override the agent's instructions.
Ingestion points: Website text, titles, and interactive element metadata are ingested into the agent context via snapshot.py and state.py.
Boundary markers: No specific delimiters or "ignore instructions" warnings are applied to the external web content before it is processed by the agent.
Capability inventory: The skill provides high-impact tools including file uploading (upload.py), JavaScript evaluation (eval.py), and simulated user interaction (click.py, type.py, press.py).
Sanitization: The js() helper in lib/runner.py uses JSON.stringify to wrap data returned from the browser environment, providing some level of structural validation.

nodriver-browser