The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes an execute function (documented in references/commands.md) that allows for the execution of arbitrary JavaScript code within the browser context. This capability can be used to manipulate page state or perform actions not covered by the standard interaction functions.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from arbitrary URLs, which are untrusted external sources. This creates a surface for indirect prompt injection attacks where a malicious website could provide instructions that override the agent's behavior.
Ingestion points: The open and goto functions allow navigation to any website, and the snapshot function retrieves the content and interactive elements of those pages.
Boundary markers: The provided documentation and templates do not include explicit instructions or markers to distinguish between the skill's commands and the content retrieved from the web.
Capability inventory: The skill possesses significant capabilities including arbitrary JavaScript execution, file uploads, and network navigation.
Sanitization: There is no evidence of content sanitization or filtering to protect the agent from malicious instructions embedded in web pages.
[DATA_EXFILTRATION]: The skill provides mechanisms that could be used for data exfiltration. The execute function can be used to retrieve sensitive session information such as cookies (as demonstrated in references/authentication.md). Additionally, the upload action in the interact function allows local files to be uploaded to a browser session, which could then be sent to a remote server.
[EXTERNAL_DOWNLOADS]: The skill instructions and documentation recommend installing the belt-sh/cli tool via npx and require logging into the inference.sh service to function.

agent-browser