The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates arbitrary JavaScript execution in connected browser tabs. In assets/extension/background.js, it uses chrome.scripting.executeScript with eval() and new AsyncFunction() to run code provided by the agent. It also utilizes the chrome.debugger API, which provides low-level control over the browser instance.
[DATA_EXFILTRATION]: The skill can extract sensitive information from the browser and save it locally. In assets/extension/background.js, the handleCookies function uses chrome.cookies.getAll to retrieve cookies for any domain. The evidence and screenshot commands in scripts/browser.py extract rendered DOM structures and screenshots, writing them to the local filesystem.
[COMMAND_EXECUTION]: The Python backend in scripts/tmwd_bridge/TMWebDriver.py starts a local HTTP server (port 18766) providing a /link endpoint. This endpoint accepts and executes execute_js commands, effectively allowing any local application or process to perform arbitrary actions in the browser sessions managed by the bridge.
[COMMAND_EXECUTION]: The extension manifest (assets/extension/manifest.json) requests the management permission, and background.js implement methods to list, enable, and disable other browser extensions. This capability can be used to disable security extensions or harvest information about the browser environment.
[PROMPT_INJECTION]: The skill is inherently vulnerable to indirect prompt injection due to its core function of ingesting and processing content from arbitrary web pages.
Ingestion points: scripts/tmwd_bridge/simphtml.py extracts text and HTML from browser tabs for agent processing.
Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore commands embedded in the extracted web content.
Capability inventory: The skill possesses powerful capabilities including local file writing, cookie extraction, and the ability to execute further JavaScript in the browser.
Sanitization: While the tool simplifies HTML to reduce token usage in simphtml.py, it does not sanitize the text content for potentially malicious instructions directed at the agent.

browser-bridge