The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides an eval command that allows the agent to execute arbitrary JavaScript within the browser context. This enables logic that bypasses the tool's predefined CLI constraints, potentially allowing for complex data exfiltration or unauthorized actions within a page session.
[INDIRECT_PROMPT_INJECTION]: The tool's primary purpose is to ingest and act upon content from external websites, creating a large surface for indirect prompt injection. Malicious instructions embedded in a web page could be processed by the agent, leading to unintended tool usage.
Ingestion points: agent-browser snapshot and agent-browser get text (SKILL.md)
Boundary markers: The skill recommends using AGENT_BROWSER_CONTENT_BOUNDARIES to wrap page output (SKILL.md).
Capability inventory: Extensive capabilities including click, fill, eval, and auth login (SKILL.md, references/commands.md).
Sanitization: No sanitization is performed on ingested page data before delivery to the agent.
[DATA_EXFILTRATION]: The skill facilitates the storage of session states, cookies, and authentication credentials in local JSON files. Additionally, the --allow-file-access flag permits the browser to read local files, which could be abused to access sensitive host information if the agent navigates to an attacker-controlled page.
[EXTERNAL_DOWNLOADS]: The skill relies on external software, specifically the appium package for mobile automation and the agent-browser tool itself, which is executed via npx from the NPM registry.

agent-browser