The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download a script from 'https://cli.inference.sh' to a temporary directory and execute it with 'bash'. This is a high-risk remote code execution pattern from a source that is not recognized as a trusted vendor.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of an installation script and interacts with various external web domains during automation tasks.
[DYNAMIC_EXECUTION]: The 'execute' function in the 'agentic-browser' provider allows for the running of arbitrary JavaScript code within the active browser session, which could be exploited for malicious actions or unauthorized data access.
[COMMAND_EXECUTION]: The skill extensively utilizes the 'Bash' tool to run CLI commands for browser control, providing a broad interface for system interaction.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Evidence chain: 1. Ingestion: 'snapshot' and 'get text' functions in SKILL.md read untrusted data from live web pages into the agent's context. 2. Boundary markers: Absent. 3. Capability inventory: Access to 'Bash', file system, and network operations. 4. Sanitization: Absent.
[PERSISTENCE]: The skill includes 'infsh login' and 'state save' commands that store authentication tokens and browser session states (like cookies and local storage) on the local filesystem.
[PRIVILEGE_ESCALATION]: The use of the '--allow-file-access' flag with the 'agent-browser' tool explicitly bypasses standard browser security sandboxing to permit the agent to read local files.

browser-automation