The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to connect to the user's already-running Chrome instance via the Chrome DevTools Protocol (CDP). This allows the agent to access sensitive data within the user's active browser session, including open tabs, authentication cookies, and personal information. The capture_screenshot() function further enables the capture of visual data from any webpage the user is visiting.
[COMMAND_EXECUTION]: The skill relies on a CLI tool (browser-harness) to execute complex browser interactions and manage background processes. It includes commands to start remote daemons (start_remote_daemon) and interact with local Unix sockets (/tmp/bu-<NAME>.sock), which could be misused to control system resources or intercept browser traffic.
[EXTERNAL_DOWNLOADS]: The maintenance command browser-harness --update -y indicates a mechanism for fetching and installing software updates from a remote source. Without explicit source verification or integrity checking in the instructions, this feature could be used to deliver and execute malicious code updates.
[PROMPT_INJECTION]: As an agent-driven tool for web interaction and scraping, the skill is inherently vulnerable to indirect prompt injection. If the agent navigates to a malicious website, the site's content could contain instructions designed to hijack the agent's behavior via the browser control capabilities.
Ingestion points: Web content processed during new_tab, wait_for_load, and scraping operations.
Boundary markers: None specified in the instructions to distinguish between agent commands and site content.
Capability inventory: Full browser control (navigation, clicking, typing), screenshot capture, and local CLI execution.
Sanitization: No evidence of content filtering or prompt sanitization before processing web data.

browser-harness