The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external websites via snapshots and text extraction, creating a surface for indirect prompt injection attacks.
Ingestion points: agent-browser snapshot, agent-browser get text, and agent-browser eval (found in SKILL.md and references/snapshot-refs.md).
Boundary markers: The skill includes a --content-boundaries feature to help distinguish page content from instructions, though it is opt-in.
Capability inventory: The tool supports network navigation, file writing (screenshots, PDFs), and arbitrary JavaScript execution.
Sanitization: Mitigation relies on the use of provided content boundaries and the agent's interpretation.
[COMMAND_EXECUTION]: The agent-browser eval command enables the execution of arbitrary JavaScript within the browser context. While restricted to the browser environment, this capability allows for data extraction and interaction with web applications based on potentially malicious input.
[DATA_EXFILTRATION]: The skill provides the ability to access local filesystem resources via file:// URLs when the --allow-file-access flag is used. This capability allows the agent to read local files (e.g., PDFs or HTML documents) for processing or capture.
[EXTERNAL_DOWNLOADS]: The skill instructions utilize npx agent-browser, which fetches and executes the browser automation tool from the npm package registry at runtime.

agent-browser