The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation guide in references/install.md instructs the user or agent to execute a remote script via curl -fsSL https://browser-use.com/profile.sh | sh. This 'curl pipe to shell' pattern allows for arbitrary code execution from an external source without prior verification.
[COMMAND_EXECUTION]: The skill uses a CLI tool (browser-harness) to execute arbitrary Python code blocks provided in the instructions. This tool has the capability to start daemons, manage local/remote browser sessions, and interact with the file system (e.g., writing to /tmp/extracted.txt).
[DATA_EXFILTRATION]: The skill's primary design is to access and extract data from 'login-walled' and authenticated browser sessions (e.g., LinkedIn, X/Twitter). This capability allows the agent to access sensitive user cookies, personal information, and private communications if directed to do so.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it is designed to ingest and process content from third-party websites.
Ingestion points: Reads arbitrary web page content via js (innerText) and visual data via capture_screenshot as described in SKILL.md.
Boundary markers: None identified in the provided instructions; untrusted content is processed directly.
Capability inventory: Includes file writing (with open(...) as f: f.write(text)), network requests (http_get), and full browser control via CDP.
Sanitization: No evidence of input validation, sanitization, or escaping of the content extracted from external websites.

browser-harness