The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded in external web content processed during browsing. 1. Ingestion points: Untrusted web data enters the agent context via page text extraction in 'templates/capture-workflow.sh' and element snapshots described in 'references/snapshot-refs.md'. 2. Boundary markers: No delimiters or warnings are used to isolate this content from agent instructions. 3. Capability inventory: The skill has access to 'Bash(belt *)' and the 'execute' function for JavaScript execution. 4. Sanitization: No filtering or validation of processed web content is performed.
[DYNAMIC_EXECUTION]: The 'execute' function provides a capability to run arbitrary JavaScript code on any navigated page. While essential for the skill's purpose, it creates a surface for complex browser interactions that could be abused to perform actions on behalf of the user or extract data.
[DATA_EXFILTRATION]: Documentation in 'references/authentication.md' details how to extract 'document.cookie' and performance resource entries using JavaScript. This functionality could be used to harvest sensitive session identifiers if the agent is directed to malicious sites.

agent-browser