The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on the agent-browser CLI to perform automation tasks. It uses shell scripts and direct CLI invocations to navigate the browser, interact with elements, and manage system resources (e.g., templates/authenticated-session.sh, references/commands.md).
[REMOTE_CODE_EXECUTION]: The skill provides the agent-browser eval command, which allows for the dynamic execution of arbitrary JavaScript within the browser context. Furthermore, the agent-browser skills get command is used to download updated instructions and templates from a remote service, representing a dynamic loading mechanism for skill logic (references/commands.md, SKILL.md).
[DATA_EXFILTRATION]: The skill includes features to capture and store browser authentication states (including cookies and localStorage) to local JSON files. While the documentation recommends best practices like encryption (AGENT_BROWSER_ENCRYPTION_KEY) and ignoring state files in version control, these files contain sensitive plaintext session tokens by default (references/authentication.md, references/session-management.md).
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from external websites that the agent then processes to make decisions.
Ingestion points: External web content is ingested through accessibility tree snapshots (snapshot -i), HTML extraction (get html), and text content extraction (get text) (SKILL.md, references/commands.md).
Boundary markers: The templates do not currently provide explicit boundary markers or instructions to the agent to disregard embedded directives within the ingested web content.
Capability inventory: The skill grants the agent high-privilege capabilities including element interaction, JavaScript execution, file uploads, and network request manipulation (references/commands.md, references/proxy-support.md).
Sanitization: There is no evidence of sanitization or filtering of the external data before it is presented to the agent's context.

agent-browser