The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites via the agent-browser open and agent-browser snapshot commands. This content is processed by the AI agent to determine subsequent actions, creating a significant attack surface for indirect prompt injection where a malicious website could attempt to override the agent's instructions.
Ingestion points: agent-browser snapshot and agent-browser get text return raw web content to the agent context.
Boundary markers: The documentation suggests basic headers (e.g., 'Page:', 'URL:') but does not specify robust delimiters or sanitization for the ingested text.
Capability inventory: The skill allows execution of the agent-browser CLI, which includes navigation, interaction, and data extraction.
Sanitization: No specific sanitization or filtering of web content is mentioned before it is returned to the agent.
[DATA_EXFILTRATION]: The tool supports the file:// protocol in the open command, which allows the agent to read local files from the host system. While a standard browser feature, this could be exploited to expose sensitive local data if the agent is misdirected.
[DYNAMIC_EXECUTION]: The agent-browser eval command allows the execution of arbitrary JavaScript within the browser context. This is a powerful feature that could be used to manipulate page state or bypass client-side security controls if the agent is compromised or tricked.
[CREDENTIALS_UNSAFE]: The skill facilitates the handling of sensitive session data through the agent-browser state save and agent-browser cookies commands. The documentation correctly identifies these as sensitive and advises against committing state files to version control, which is a standard security practice for this type of tool.

agent-browser