The Agent Skills Directory

[DYNAMIC_EXECUTION]: The execute function defined in references/commands.md allows the agent to run arbitrary JavaScript code on any web page it navigates to. This capability, while central to the skill's purpose, can be used to extract sensitive information like session cookies (document.cookie) or perform unauthorized actions on behalf of the user within the browser session.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface for indirect prompt injection as it processes untrusted data from the web.
Ingestion points: Data from external websites is brought into the agent's context through the snapshot function, which returns elements_text, and the execute function, which returns the result of JavaScript execution.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between its operational instructions and untrusted content retrieved from the web.
Capability inventory: The agent possesses powerful capabilities including execute (for JS injection), interact (for clicking, typing, and form filling), and upload (for interacting with local files).
Sanitization: The skill does not perform sanitization or validation of the text content extracted from web pages before presenting it to the agent.
[COMMAND_EXECUTION]: The upload action within the interact function (documented in references/commands.md) allows the agent to specify local file_paths to be uploaded to a web form. This provides the agent with a mechanism to read and potentially exfiltrate local files if it is manipulated into interacting with a file upload field on a malicious or compromised website.

agent-browser