The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides an eval command that executes arbitrary JavaScript within the browser context. This allows for dynamic code execution to interact with web page internals, which could be exploited if an agent processes malicious site content.
[DATA_EXFILTRATION]: The skill includes commands to read the host clipboard (clipboard read) and export sensitive browser session data (state save), including cookies and authentication tokens. This creates a potential path for data exfiltration if the agent is directed to send this information externally.
[CREDENTIALS_UNSAFE]: Browser session states and credentials managed by the auth and state commands are stored in plaintext files by default. Although the documentation mentions an optional encryption key (AGENT_BROWSER_ENCRYPTION_KEY), the default behavior poses a risk of credential exposure.
[COMMAND_EXECUTION]: The skill can interact with the local file system using the --allow-file-access flag and the upload command, enabling the headless browser to read local documents and upload them to web services.
[PROMPT_INJECTION]: As a tool for web interaction, the skill is susceptible to indirect prompt injection where malicious instructions embedded in web pages could influence the agent's behavior. The skill includes an optional AGENT_BROWSER_CONTENT_BOUNDARIES feature to help the agent distinguish between tool output and untrusted content.
Ingestion points: Browser snapshots and text extraction via snapshot and get text commands.
Boundary markers: Optional markers available via the AGENT_BROWSER_CONTENT_BOUNDARIES environment variable.
Capability inventory: Form filling, element clicking, JavaScript execution (eval), and credential state management (state save).
Sanitization: Relies on optional boundary markers and agent-side filtering to identify untrusted content.

agent-browser