The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documents and encourages the use of the auth save command with a --password flag, which involves passing sensitive credentials as plaintext command-line arguments. This is an insecure practice as it exposes passwords to process listing tools and shell history files.
[DYNAMIC_EXECUTION]: The agent-browser eval command and the wait --fn flag allow for the execution of arbitrary JavaScript within the browser context. This provides a powerful vector for malicious activity if the agent is directed to execute untrusted scripts.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to browse and extract content from websites, making it susceptible to indirect prompt injection attacks where malicious web content could override agent instructions.
Ingestion points: Browser snapshots and text extraction functions found in SKILL.md and references/commands.md.
Boundary markers: No markers or instructions are provided to distinguish between data and potential commands within the ingested web content.
Capability inventory: The skill possesses extensive capabilities including full browser control, file uploads, credential management, and JavaScript execution.
Sanitization: No sanitization or validation of the content retrieved from the browser is described.
[DATA_EXFILTRATION]: The skill includes commands to save browser state (state save) and authentication details (auth save) to the local file system. These capabilities could be misused to harvest session tokens or login credentials for unauthorized access.
[COMMAND_EXECUTION]: The skill uses a CLI to control browser processes, manage files, and can connect to existing browser instances via the connect command, which could lead to unauthorized session interaction or local file system manipulation.

agent-browser