The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documents workflows for saving browser session state (including cookies and local storage) to local files or named session directories. While it supports encryption via the AGENT_BROWSER_ENCRYPTION_KEY environment variable, the default behavior involves storing session tokens in plaintext auth.json files, as noted in the documentation.
[DYNAMIC_EXECUTION]: The agent-browser eval command enables the execution of arbitrary JavaScript within the browser context. This capability allows for complex interactions but also presents a vector for executing untrusted scripts if the agent is compromised.
[OBFUSCATION]: The CLI supports a --base64 (-b) flag for the eval command. This allows for the execution of Base64-encoded JavaScript strings, which can be used to mask the intent of scripts and evade simple text-based security scanners.
[PRIVILEGE_ESCALATION]: The skill provides an --allow-file-access flag that permits the browser to navigate to and read local files using file:// URLs. This could be exploited to access sensitive system files like SSH keys or cloud credentials if the agent is directed to local paths.
[INDIRECT_PROMPT_INJECTION]: As a web automation tool, the skill ingests significant amounts of untrusted data from the internet via commands like snapshot and get text. The skill author provides AGENT_BROWSER_CONTENT_BOUNDARIES as a mitigation to help agents distinguish between tool output and untrusted page content.
Ingestion points: snapshot, get text, screenshot, clipboard read (found in SKILL.md and references/commands.md)
Boundary markers: AGENT_BROWSER_CONTENT_BOUNDARIES is available as an opt-in environment variable (found in SKILL.md).
Capability inventory: open, click, fill, eval, state save, clipboard write, network route (found in SKILL.md and references/commands.md).
Sanitization: Content is not sanitized by default; the user must enable content boundaries to delimit external output.

agent-browser