The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the web using commands like open, snapshot, and get text. When combined with the skill's capabilities to write files (screenshot, pdf, state save) and execute commands via the terminal, this creates a significant indirect prompt injection surface.\n
Ingestion points: Browser navigation and data extraction commands (SKILL.md, references/commands.md).\n
Boundary markers: The skill documentation recommends and describes an optional --content-boundaries flag to delimit untrusted page content (SKILL.md).\n
Capability inventory: File system writing, terminal command execution, and network operations.\n
Sanitization: The skill provides a mechanism for boundary markers but does not enforce sanitization of extracted text within the provided script templates.\n- [DYNAMIC_EXECUTION]: The eval command (and its variants --stdin and -b) allows the execution of arbitrary JavaScript code within the browser context. This facilitates the execution of complex logic but also provides a vector for running malicious scripts if the evaluated content is derived from untrusted sources.\n- [DATA_EXFILTRATION]: Several features allow access to potentially sensitive information that could be exfiltrated. The clipboard read command can retrieve data from the host system's clipboard, and the --allow-file-access flag enables the browser to open and read local files using the file:// protocol.\n- [CREDENTIALS_UNSAFE]: The state save functionality stores session tokens, cookies, and localStorage data in plaintext files (auth.json) by default. While the documentation recommends using an encryption key and gitignoring these files, the default behavior poses a risk of credential exposure.

agent-browser