The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by design, as it enables the agent to ingest and process untrusted data from external websites.
Ingestion points: Web content is brought into the agent's context through commands like agent-browser snapshot, agent-browser get text, and agent-browser get html as documented in SKILL.md.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore instructions embedded within the retrieved web content.
Capability inventory: The skill provides significant capabilities that could be exploited by an injection attack, including local file writing (screenshot, pdf, state save), arbitrary JavaScript execution (eval), and network interaction (open).
Sanitization: There is no mention of sanitization or filtering of the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill provides an agent-browser eval command that allows the execution of arbitrary JavaScript within the browser context. While standard for browser automation, this feature could be leveraged if the agent is successfully targeted by a prompt injection attack to perform unauthorized actions within a web session.

agent-browser