The Agent Skills Directory

[DYNAMIC_EXECUTION]: The browser-eval.js script uses the new AsyncFunction constructor to execute arbitrary JavaScript code passed via command-line arguments. This enables dynamic code generation and execution within the browser context, which can be used to manipulate web pages or extract data.
[DATA_EXFILTRATION]: The browser-cookies.js tool retrieves all cookies from the active browser session, including sensitive authentication and session tokens, and outputs them to the console where they are visible to the agent.
[DATA_EXFILTRATION]: The browser-start.js tool features a --profile flag that uses rsync to copy the user's entire Google Chrome profile directory (containing history, cookies, and saved credentials) to a local cache directory for the agent, exposing high-value personal data.
[COMMAND_EXECUTION]: The browser-start.js script uses spawn and execSync to launch the Chrome binary with remote debugging flags and to perform filesystem operations like directory creation and the removal of process lock files.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting and processing content from arbitrary external websites.
Ingestion points: External web content is loaded and parsed in browser-nav.js and browser-content.js.
Boundary markers: There are no instructions or delimiters implemented to prevent the agent from following instructions embedded in the processed web pages.
Capability inventory: The skill includes high-privilege capabilities such as arbitrary JS execution, cookie reading, and screenshot capture.
Sanitization: While the HTML is converted to markdown for readability, this process does not filter out malicious natural language instructions.

browser-tools