The Agent Skills Directory

[DATA_EXFILTRATION]: The skill documents the use of the --allow-file-access flag to open local files via the file:// protocol. This capability creates a risk for sensitive data exposure if the agent is directed to read system configuration files or private keys.\n- [DATA_EXFILTRATION]: Authentication state, which may contain sensitive cookies and session tokens, can be persisted to local files using the state save command. If these files are not handled with appropriate security measures, they could lead to credential exposure.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves and processes content from external websites. An attacker could place malicious instructions on a web page to manipulate the agent's behavior.\n
Ingestion points: Untrusted data enters the agent context through agent-browser open, snapshot, and get text commands targeting external URLs in SKILL.md.\n
Boundary markers: The instructions do not provide any guidance on using delimiters or markers to isolate scraped content from internal instructions.\n
Capability inventory: The tool includes capabilities to write files (screenshots, PDFs, and state files) and perform subsequent network requests.\n
Sanitization: There is no mention of sanitizing, filtering, or validating the content retrieved from web pages before processing.\n- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the appium package and its drivers via the Node Package Manager (npm), which is a well-known service for software distribution.\n- [COMMAND_EXECUTION]: The skill facilitates the execution of the agent-browser CLI tool through Bash for performing browser automation tasks.

agent-browser