The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides an execute function that allows for the execution of arbitrary JavaScript code within the browser context. While this is a core feature for web automation, it represents a significant dynamic execution surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate and extract data from external websites. This content is untrusted and could contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: The open, snapshot, and execute functions all ingest content from external URLs (found in SKILL.md and references/commands.md).
Boundary markers: The skill does not implement specific delimiters or warnings for the agent to ignore instructions embedded in the extracted web content.
Capability inventory: The skill possesses powerful capabilities including arbitrary JavaScript execution (execute), element interaction (interact), and file uploads (interact with upload action).
Sanitization: There is no evidence of sanitization or filtering of the content extracted from web pages before it is presented to the agent.
[DATA_EXFILTRATION]: The documentation explicitly provides examples and instructions for using JavaScript to extract sensitive session information, such as cookies, from the browser environment (found in references/authentication.md).

agent-browser