The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it ingests and processes untrusted data from external websites. \n
Ingestion points: Untrusted data enters the agent context through commands like agent-browser snapshot, agent-browser get text, and agent-browser find which retrieve content from web pages. \n
Boundary markers: There are no specific instructions or delimiters provided to warn the agent to ignore or isolate instructions that might be embedded in the retrieved web content. \n
Capability inventory: Across the provided scripts and documentation, the agent has the capability to execute shell commands (agent-browser), write files (screenshot, pdf, state save), and manage network sessions. \n
Sanitization: No evidence of sanitization or filtering of web content before it is processed by the agent is present in the instructions. \n- [COMMAND_EXECUTION]: The skill documentation encourages the use of an eval command to run arbitrary JavaScript in the browser context, which represents a high-impact capability. \n
Evidence: The SKILL.md and references/commands.md files provide extensive documentation on using agent-browser eval to execute JS, including methods using stdin and base64 encoding to bypass shell escaping issues.

agent-browser