The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate to external websites and extract their content, creating a large surface for indirect prompt injection attacks.
Ingestion points: The skill uses snapshot, get text, get html, and console commands (as documented in references/commands.md) to pull data from live web pages into the agent's context.
Boundary markers: There are no instructions or delimiters defined to wrap extracted content or warn the agent against following embedded instructions.
Capability inventory: The agent has extensive browser control capabilities, including clicking, filling forms, uploading files, and executing arbitrary JavaScript, which could be abused if an injection is successful.
Sanitization: The skill documentation and templates do not provide any evidence of sanitization or filtering for the extracted data.
[DYNAMIC_EXECUTION]: The skill explicitly provides a mechanism for dynamic code execution in the browser environment.
Evidence: The references/commands.md file documents the agent-browser eval command, supporting both --stdin and -b/--base64 flags for executing arbitrary JavaScript.
Risk: This capability allows for complex interactions and data extraction that could be used for malicious purposes if the input to the eval command is influenced by untrusted external data.
[OBFUSCATION]: The skill encourages the use of Base64 encoding for executing JavaScript to avoid shell escaping issues.
Evidence: references/commands.md provides an example of a Base64-encoded selector: agent-browser eval -b "ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignW3NyYyo9Il9uZXh0Il0nKQ==".
[COMMAND_EXECUTION]: The skill operates by executing a local CLI tool agent-browser with various subcommands.
Evidence: The SKILL.md and references/commands.md files list numerous shell commands for browser navigation, interaction, and state management.

agent-browser