The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation in SKILL.md provides an installation command curl -fsSL https://cli.inference.sh | sh that pipes a remote script into the shell. As this is hosted on the vendor's own domain, it is considered a standard delivery method for their CLI tool.
[COMMAND_EXECUTION]: The allowed-tools section in SKILL.md specifies Bash(infsh *), which allows the agent to execute the vendor's CLI commands.
[REMOTE_CODE_EXECUTION]: Through the execute function described in references/commands.md, the skill allows the agent to run arbitrary JavaScript code within the browser context. This enables dynamic code execution on external websites.
[DATA_EXFILTRATION]: The skill includes documentation on extracting sensitive browser data; for example, references/authentication.md shows how to use the execute function to retrieve document.cookie and other authentication-related metadata.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core function of ingesting web data.
Ingestion points: Functions like open, snapshot, and execute return external content (text, element descriptions) into the agent's context.
Boundary markers: There are no instructions or delimiters in the documentation to help the agent distinguish between untrusted web content and system instructions.
Capability inventory: The agent possesses powerful capabilities including bash command execution and JavaScript execution, which could be leveraged if it follows instructions embedded in a web page.
Sanitization: The skill lacks explicit sanitization or filtering mechanisms for the data it retrieves from the internet.

agent-browser