The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/ego-browser script functions as a bridge that accepts arbitrary Node.js code from the agent via stdin and executes it on a remote macOS host (carries-macbook-air.burro-salmon.ts.net) using SSH.
[EXTERNAL_DOWNLOADS]: The assets/upstream-install.sh script downloads binary disk images (DMG) from https://cdn.ego.app/setup/macos/arm64/egolite.dmg and https://cdn.ego.app/setup/macos/x64/egolite.dmg to install the Chromium-based application on the host Mac.
[DYNAMIC_EXECUTION]: The skill's primary operational mode involves generating and executing dynamic Node.js and browser-side JavaScript at runtime to drive browser tasks and interact with DOM elements.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it ingests untrusted data from arbitrary websites (e.g., Google, GitHub, X) and has access to powerful capabilities like click, fillInput, typeText, and uploadFile without explicit boundary markers or sanitization of the extracted content.
Ingestion points: Scrapers for Google Search, GitHub, and X (Twitter) in the learnings/ directory.
Boundary markers: Absent; extracted page content is returned directly to the agent context.
Capability inventory: click, fillInput, typeText, uploadFile, js, cdp, and serverFetch are available to the agent.
Sanitization: boundedInteger is used for result limits, but no sanitization is performed on text extracted from web pages.
[PRIVILEGE_ESCALATION]: The assets/upstream-install.sh script utilizes sudo for file removal and installation tasks. Additionally, references/remote-architecture.md instructs the user to run sudo pmset commands to modify system-level sleep and power configurations on the macOS host.
[DATA_EXFILTRATION]: The skill is explicitly designed to access and extract data from authenticated web sessions, including banking, cloud provider consoles (AWS root), and SaaS administrative panels.

ego-browser