The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation and implementation rely on the agent executing CLI commands via uv run to interact with a local browser server.
[DYNAMIC_EXECUTION]: The skill makes extensive use of dynamic code execution:
Browser Scripting: Uses page.evaluate() to inject and run JavaScript in the target website's context for element discovery and ARIA snapshot generation.
Agent Scripting: The documentation encourages the agent to generate and execute its own Python scripts using a heredoc pattern (uv run python <<'EOF') to handle complex automation logic and event listeners.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality:
Ingestion points: The agent ingests untrusted data from the open web, including HTML source code, accessibility trees via the snapshot command, and intercepted API responses.
Boundary markers: There are no specific instructions or delimiters provided to help the agent distinguish between skill instructions and data found on external websites.
Capability inventory: The skill possesses significant capabilities, including the ability to write files (screenshots and data logs), perform network requests, and execute arbitrary code, which could be abused if the agent follows instructions embedded in a malicious webpage.
Sanitization: No evidence of sanitization or filtering of ingested web content before it is processed by the agent.

browser