The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites, creating a surface for indirect prompt injection where malicious web content could influence agent behavior.
Ingestion points: The snapshot and get commands (e.g., agent-browser snapshot, agent-browser get text) in SKILL.md ingest content from arbitrary web pages into the agent's context.
Boundary markers: The instructions do not specify the use of delimiters or instructions to ignore embedded commands when processing data from these snapshots.
Capability inventory: The skill possesses the ability to click, fill forms, navigate URLs, and take screenshots, which could be abused if the agent inadvertently follows instructions hidden within a webpage's accessibility tree or text.
Sanitization: There is no mention of sanitizing or validating the content retrieved from the browser before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill instructions include downloading an external CLI tool and browser binaries from a public registry.
Evidence: The setup section in SKILL.md documents the use of npm install -g agent-browser to install the tool and agent-browser install to download the Chromium browser.
[COMMAND_EXECUTION]: The skill operates by executing shell commands to control the browser automation tool.
Evidence: Numerous examples in SKILL.md demonstrate the use of CLI commands such as agent-browser open, agent-browser click, and agent-browser fill to perform tasks.

agent-browser