The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute agent-browser CLI commands. These commands interact with a browser daemon to perform complex web automation, including clicking, typing, and navigating.
[EXTERNAL_DOWNLOADS]: The allowed-tools configuration uses npx agent-browser:*, which downloads and runs the agent-browser package from the NPM registry. It also mentions installing additional drivers like appium for mobile emulation.
[PROMPT_INJECTION]: The skill ingests untrusted data from external websites via snapshots and text extraction, creating an indirect prompt injection surface. The documentation explicitly suggests using --content-boundaries to help the agent distinguish between tool output and external content.
Ingestion points: agent-browser snapshot, agent-browser get text, and agent-browser screenshot (SKILL.md, templates/capture-workflow.sh).
Boundary markers: The skill provides a --content-boundaries flag to wrap extracted content in unique nonces (SKILL.md).
Capability inventory: The agent can interact with pages (click, fill) and execute JavaScript via eval (references/commands.md).
Sanitization: Page content is returned as-is; security relies on the LLM's ability to handle the context markers.
[DATA_EXFILTRATION]: The skill provides commands to save browser session states, including cookies and localStorage, to local files. It also allows extracting all text from a page and saving it to the filesystem (references/session-management.md).
[COMMAND_EXECUTION]: The eval command allows the execution of arbitrary JavaScript within the browser. The tool supports Base64-encoded JavaScript to ensure reliable execution across different shell environments (references/commands.md).

agent-browser