The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it allows the agent to navigate to and process content from untrusted websites.
Ingestion points: Content is ingested from the web using agent-browser snapshot, agent-browser open, and data retrieval commands like agent-browser get text (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters to help the agent distinguish between its core instructions and the potentially adversarial content it scrapes from the web.
Capability inventory: The agent possesses powerful capabilities through the Bash tool, including session state management (state save/load), cookie access (cookies), and the ability to execute JavaScript in the browser (eval).
Sanitization: No sanitization or validation of the retrieved web content is specified in the skill's workflow.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute the agent-browser CLI. This provides the agent with the ability to perform complex browser operations and file system interactions on the host machine.
[EXTERNAL_DOWNLOADS]: The skill instructions include downloading the agent-browser package via npm and downloading the Chromium browser environment using agent-browser install (SKILL.md). These are standard installation procedures for the tool's intended use-case.

agent-browser