The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by executing agent-browser CLI commands through a shell interface. It supports command chaining with && and background daemons for session persistence.
[DYNAMIC_EXECUTION]: The eval and wait --fn commands allow the execution of arbitrary JavaScript within the browser context. This is used for complex page interactions, custom data extraction, and verifying page states. The documentation correctly suggests using Base64 encoding or stdin to safely pass complex JavaScript through the shell.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external websites, which presents a surface for indirect prompt injection attacks where malicious instructions are hidden in web pages.
Ingestion points: Untrusted data enters the agent context via page snapshots, accessibility trees, and text extraction commands (get text, snapshot).
Boundary markers: The skill includes an optional --content-boundaries flag that wraps page-sourced output in nonce-based markers to help the agent distinguish between tool output and system instructions.
Capability inventory: The skill possesses extensive capabilities including full browser interaction, JavaScript execution, state management (cookies/storage), and local file access.
Sanitization: While no automated text sanitization is performed, the content boundary system is provided as a recommended mitigation for AI agents.
[DATA_EXFILTRATION]: The skill provides a capability to access local system files using file:// URLs. This feature is restricted by an explicit --allow-file-access flag and is intended for processing local documents like PDFs and HTML files.

agent-browser