The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes content from external, untrusted websites.\n
Ingestion points: Web page content, accessibility trees, and element data are retrieved from external URLs using commands like open, snapshot, and get (SKILL.md).\n
Boundary markers: The instructions do not provide delimiters or specific warnings to ignore instructions that may be embedded within the retrieved web content.\n
Capability inventory: The agent has the ability to write to the local file system (screenshots, PDFs, video recordings, traces) and perform further network navigation via the agent-browser tool (SKILL.md), which could be controlled by injected instructions.\n
Sanitization: No evidence of sanitization or filtering of content retrieved from web pages is present.\n- [COMMAND_EXECUTION]: The tool includes an eval command that enables the execution of arbitrary JavaScript within the browser context.\n- [DATA_EXFILTRATION]: The tool supports the file:// protocol for navigation and file uploads via the upload command, which could be used to access local files. It also provides functionality to extract and save browser state, such as cookies and local storage, to files.\n- [EXTERNAL_DOWNLOADS]: The skill is attributed to and provides instructions for installation from the vercel-labs/agent-browser repository, which is a recognized source for this tooling.

agent-browser