The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly documents the filesystem path to sensitive authentication data, specifically the session cookies located at ~/.openclaw/browser/openclaw/user-data/Default/Cookies. Providing this path simplifies potential exfiltration of active user sessions by malicious actors or through prompt injection.
[COMMAND_EXECUTION]: Instructions include executing system-level commands with administrative privileges using sudo dpkg -i to install browser binaries. It also encourages the use of the --no-sandbox flag, which disables critical security isolation features of the Chromium browser on Linux environments.
[EXTERNAL_DOWNLOADS]: The skill guides the installation of external software and dependencies, including the download of the Chrome stable package from Google's official servers and the global installation of the Playwright package from the NPM registry.
[REMOTE_CODE_EXECUTION]: The evaluate action enables the agent to execute arbitrary JavaScript functions (fn) within the browser's context. This capability can be leveraged to interact with page content or perform actions on behalf of the user, but it also creates a vector for executing code influenced by untrusted external websites.
[PROMPT_INJECTION]: The skill exposes a significant surface for indirect prompt injection by ingesting and processing untrusted data from web pages via DOM and ARIA snapshots.
Ingestion points: Web page DOM content and ARIA trees enter the agent context through snapshot and tabs actions.
Boundary markers: The skill does not define specific delimiters or instructions to treat web content as untrusted data.
Capability inventory: The agent has extensive capabilities including file-system interaction, network navigation, and JavaScript execution.
Sanitization: There is no mention of sanitizing or escaping content retrieved from external sites before it is processed by the agent.

browser-automation