The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires running ego-cli skills get <name> to fetch command syntax, flags, and workflows from a remote source at runtime. This dynamic loading means the actual logic executed by the agent is not contained within the static skill files and can be updated or changed by the vendor at any time.
[COMMAND_EXECUTION]: The skill documentation describes ego-cli eval, which allows the execution of arbitrary JavaScript within the browser. This includes a Base64-encoded option (-b) which can be used to execute complex, potentially obfuscated scripts.
[DATA_EXFILTRATION]: The skill provides tools for capturing and saving browser state, including cookies and session tokens, to local files (ego-cli state save). While useful for automation, this capability can be abused to harvest sensitive authentication data if directed at malicious or compromised sites.
[PROMPT_INJECTION]: The skill is highly susceptible to Indirect Prompt Injection. It ingests untrusted data from websites (via snapshot and get text) and possesses powerful capabilities.
Ingestion points: Browser navigation (open), page snapshots (snapshot -i), and text extraction (get text).
Boundary markers: None observed; the skill does not appear to use delimiters or 'ignore' instructions when processing page content.
Capability inventory: The skill has full browser control, including eval (JavaScript execution), file system writes (screenshot, pdf, state save), and network routing/blocking.
Sanitization: None observed; the raw accessibility tree and page text are provided directly to the agent.

ego-cli