The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides an eval command that allows the execution of arbitrary JavaScript within the browser context. This dynamic execution surface could be exploited if the agent is instructed to run code derived from untrusted web content.
[DATA_EXFILTRATION]: The agent-browser open command explicitly supports the file:// protocol, which allows the browser to access the local filesystem. This capability can be used to read sensitive local configuration or credential files, which can then be extracted using the skill's data gathering tools like snapshot or get text.
[PROMPT_INJECTION]: The skill is designed to ingest and process content from external websites to facilitate automation. This creates a surface for Indirect Prompt Injection, where malicious instructions embedded in a webpage's HTML, metadata, or accessibility tree could attempt to hijack the agent's logic or bypass its safety constraints.
Ingestion points: Web content is ingested via agent-browser snapshot, agent-browser get text, and agent-browser console (SKILL.md).
Boundary markers: The snapshot system uses structured @ref markers, but there are no explicit instructions to the agent to ignore embedded natural language commands found within the web data.
Capability inventory: The agent has extensive capabilities including browser interaction (click, fill), script execution (eval), and session persistence (state save) (SKILL.md, references/authentication.md).
Sanitization: There is no evidence of sanitization or filtering applied to the content retrieved from the web before it is presented to the agent.
[CREDENTIALS_UNSAFE]: The skill includes patterns for handling authentication, such as agent-browser set credentials for HTTP Basic Auth and agent-browser cookies set. While the documentation recommends using environment variables, the use of state persistence files (auth-state.json) creates a risk of credential exposure if these files are not managed securely or are inadvertently uploaded to version control.

agent-browser