The Agent Skills Directory

[COMMAND_EXECUTION]: The functions browser::evaluate and browser::execute enable the execution of arbitrary JavaScript code within the context of the loaded web page.
[DATA_EXFILTRATION]: The browser::sessions::attach capability allows the skill to bind to an already-running browser via CDP (--remote-debugging-port), granting access to the user's logged-in sessions and profile data.
[DATA_EXFILTRATION]: Diagnostic functions like browser::console::read and browser::network::read capture page activity, which may include sensitive information such as authentication tokens, session headers, or private user data printed to the console or sent in network requests.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by design, as it ingests and processes untrusted content from external URLs through functions like browser::snapshot and browser::dom::read. 1. Ingestion points: Page content from browser::snapshot and browser::dom::read; network/console logs. 2. Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions for the fetched content. 3. Capability inventory: Includes arbitrary JS execution (browser::execute), UI interaction (browser::act), and file generation (browser::recording). 4. Sanitization: No evidence of input sanitization or validation of external content before it is processed by the agent.

browser