The Agent Skills Directory

[COMMAND_EXECUTION]: The eval command enables arbitrary JavaScript execution within the web context.
Evidence: The agent-browser eval -b pattern uses Base64 to execute scripts, bypassing shell interpretation and potentially hiding execution intent.
Evidence: The agent-browser eval --stdin flag allows multi-line JavaScript execution directly from input streams.
[DATA_EXFILTRATION]: Local files can be accessed and potentially exfiltrated via the browser.
Evidence: The --allow-file-access flag permits opening local system files using the file:// protocol.
Evidence: The tool allows capturing text or screenshots from these local files, which could then be processed or uploaded to external sites.
[PROMPT_INJECTION]: The skill processes untrusted external data which can contain malicious instructions (Indirect Prompt Injection).
Ingestion points: Data enters the context via agent-browser open, snapshot -i, and get text body in SKILL.md.
Boundary markers: No specific delimiters or warnings are provided to separate web-retrieved content from agent instructions.
Capability inventory: The skill has significant capabilities including file system access, network requests, and JavaScript execution.
Sanitization: No validation or filtering of external content is specified before it is processed by the agent.
[CREDENTIALS_UNSAFE]: Active session data is stored in local files, creating a potential for credential exposure.
Evidence: The agent-browser state save command exports cookies and local storage to unencrypted JSON files.
Evidence: The ~/.agent-browser/sessions/ directory is used to persist session state across restarts.
[EXTERNAL_DOWNLOADS]: The skill relies on external registries to fetch and run components.
Evidence: The allowed-tools configuration includes npx agent-browser:*, which executes code from the NPM registry.
Evidence: The documentation suggests installing the appium package for mobile automation tasks.

agent-browser