The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites via a remote browser environment, creating a surface for indirect prompt injection attacks.
Ingestion points: Data is ingested from the web using page_info(), js() execution, and accessibility tree extraction (cdp("Accessibility.getFullAXTree")).
Boundary markers: The instructions do not specify any boundary markers or instructions for the agent to ignore potentially malicious content embedded in the processed web pages.
Capability inventory: The skill uses the Bash(browser-use:*) tool to execute Python scripts, navigate URLs, and interact with a remote browser daemon.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the web before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on the browser-use CLI to perform all operations, including authentication (browser-use auth login), diagnostics, and daemon management.
[DYNAMIC_EXECUTION]: The skill pattern involves passing Python code blocks via bash heredocs (browser-use <<'PY') to be executed within the context of the remote browser automation tool.

remote-browser