The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The package-lock.json file specifies a non-existent version of a dependency (zod@4.6.5) and incorrectly flags standard packages like @openrouter/sdk as having installation scripts (hasInstallScript: true). These discrepancies suggest a supply chain attack designed to execute malicious code during the installation process.
[PERSISTENCE]: The inclusion of unusual installation script flags in the dependency lockfile represents a potential mechanism for establishing persistent access to the host machine if the skill is installed without explicit script-ignoring flags.
[COMMAND_EXECUTION]: The skill uses node:child_process.execFile to invoke an external browser binary (agent-browser). While it validates reference IDs with regular expressions, the ability to execute external binaries based on task configuration is a sensitive capability that could be abused if the task file is compromised.
[DYNAMIC_EXECUTION]: The CLI tool uses dynamic import() to load user-provided JavaScript modules for policy and authorization. This enables the execution of arbitrary JavaScript code from any file path provided to the --policy argument.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted browser accessibility snapshots and passes them to an LLM. While it includes mitigations such as mandatory sanitization and instructions for the model to treat page content as untrusted evidence, the exposure to indirect prompt injection remains a risk factor.
[EXTERNAL_DOWNLOADS]: The skill declares dependencies that must be fetched from the npm registry and communicates with the OpenRouter API to transmit UI observations and receive action decisions.

agent-browser-jev