The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to navigate to and extract content from arbitrary URLs via the open and snapshot commands. This creates a surface for indirect prompt injection, where malicious instructions hidden within a web page's content could attempt to influence the agent's logic or behavior.
Ingestion points: External web content is ingested through the agent-browser open <url> and agent-browser snapshot commands in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety prompts to prevent the agent from following instructions embedded in the processed web pages.
Capability inventory: The skill has the capability to write files to the system using agent-browser screenshot [path] and agent-browser state save [path], and it can perform network operations via browser navigation, as documented in SKILL.md.
Sanitization: There is no mention of sanitizing or filtering the content retrieved from web pages before the agent processes it.
[DATA_EXFILTRATION]: The skill includes functionality to capture screenshots (agent-browser screenshot) and save the browser's session state (agent-browser state save), which typically includes cookies and authentication tokens. While these are standard features for the intended purpose of browser automation, they could be misused to expose or exfiltrate sensitive user data or credentials from authenticated sessions.

agent-browser