The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill repeatedly instructs the user and the agent to install the software using a highly insecure method: fetching a shell script from a remote URL (https://browser-use.com/cli/install.sh) and piping it directly into bash. This bypasses integrity checks and allows the remote server to execute arbitrary code on the host system.
Evidence: Found in SKILL.md (description and metadata) and references/setup.md.
[COMMAND_EXECUTION]: The skill provides the agent with the ability to execute arbitrary Python code via browser-use python and JavaScript via browser-use eval. While these are features of the tool, they grant the agent extensive control over the local environment and the browser.
[DATA_EXFILTRATION]: The skill includes a tunnel command (browser-use tunnel 3000) that exposes local network ports to the public internet. This creates a direct vector for data exfiltration or unauthorized remote access to local services.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection, as it frequently ingests untrusted data from the web.
Ingestion points: Data is ingested via browser-use state, browser-use eval, and browser-use get text in SKILL.md.
Boundary markers: There are no defined boundary markers or instructions to the agent to ignore potentially malicious instructions found within the scraped web content.
Capability inventory: The skill utilizes the Bash tool and the browser-use CLI to execute scripts and system commands.
Sanitization: No evidence of sanitization or filtering of external content is provided in the documentation or instructions.

browser-use