The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides explicit workflows for the agent to handle and type sensitive user credentials (email and password) directly into web forms using browser automation tools.
Evidence: The 'First-time setup' and 'Step-by-Step Workflow' sections in SKILL.md instruct the agent to use browser_type for 'Enter email' and 'Enter password' fields. This practice encourages the exposure of plaintext credentials within the agent's execution context and conversation history.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external web interfaces, creating a surface for indirect prompt injection attacks.
Ingestion points: The agent captures the state and text of external websites (chat.openai.com and gemini.google.com) using the browser_snapshot tool.
Boundary markers: No boundary markers or instructions to ignore embedded commands are present to isolate the captured browser content from the agent's core instructions.
Capability inventory: The agent possesses extensive capabilities including browser_navigate, browser_click, browser_type, and browser_snapshot, which could be abused if the agent is hijacked by malicious content on a target page.
Sanitization: There is no evidence of sanitization or filtering applied to the text captured from the browser snapshots before it is processed or presented.
[COMMAND_EXECUTION]: The skill enables the execution of browser automation commands which, while serving the primary purpose of the skill, allows the agent to perform complex, multi-step actions on external websites based on user input or ingested data.

browser-automation