The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs several automated and suggested shell operations, including environment detection via node detect-env.mjs, package management with npm install, and test suite execution using npx playwright test. It also provides instructions for manually cloning and running the browser-harness CLI.
[EXTERNAL_DOWNLOADS]: The skill suggests cloning the browser-harness repository from a third-party GitHub account (browser-use/browser-harness). While it advises seeking user consent, this introduces code from an unverified source into the local environment. It also fetches standard dependencies and MCP servers from public registries.
[REMOTE_CODE_EXECUTION]: During 'Layer 1' and 'Layer 2', the skill generates Playwright TypeScript code based on user requirements and executes it. Running dynamically generated code that interacts with the browser and file system presents a risk if the generation logic is manipulated.
[PROMPT_INJECTION]: The 'Layer 2' workflow (AI Autonomous Acceptance) involves the agent navigating to and analyzing untrusted external websites. This exposes the agent to indirect prompt injection, where malicious instructions embedded in a web page's DOM, text, or metadata could attempt to hijack the agent's behavior.
Ingestion points: Processes external content via browser_snapshot and browser_take_screenshot tools.
Boundary markers: The skill lacks explicit instructions or markers to distinguish between legitimate website data and potential malicious instructions during analysis.
Capability inventory: The agent has capabilities for file system access, shell execution, and network operations, which could be abused if an injection is successful.
Sanitization: There is no evidence of input validation or content filtering for the data retrieved from external URLs.

browser-qa