The Agent Skills Directory

[DATA_EXFILTRATION]: The execute function allows the agent to run JavaScript to extract sensitive information from the browser context, such as session cookies (document.cookie) and local storage data.
[DATA_EXFILTRATION]: The interact function includes an upload action that accepts a file_paths array, enabling the agent to select and upload files from the local file system to remote web servers.
[DYNAMIC_EXECUTION]: The skill provides a mechanism to execute arbitrary JavaScript code on any visited web page via the execute function. While a standard feature for browser automation, this allows for runtime code generation and execution within the browser environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by design as it browses external websites. This exposes the agent to indirect prompt injection, where malicious content on a webpage could attempt to subvert the agent's instructions. The evidence chain for this includes:
Ingestion points: The open and goto actions navigate to arbitrary URLs, and the snapshot function retrieves the page's text content (referenced in SKILL.md and references/snapshot-refs.md).
Boundary markers: No explicit boundary markers or 'ignore' instructions for webpage content were found in the skill definitions.
Capability inventory: The skill can execute shell commands via belt, perform network requests through the browser, and upload files.
Sanitization: There is no evidence of sanitization or filtering of the HTML/text content retrieved from pages before it is presented to the agent.
[COMMAND_EXECUTION]: The skill is configured with allowed-tools: Bash(belt *) and relies on executing the belt command-line utility for all browser interactions, including session management and page navigation.

agent-browser