The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it is designed to ingest and process content from untrusted external websites.
Ingestion points: Page content is ingested via snapshot, get text, and screenshot --annotate as described in SKILL.md.
Boundary markers: The skill provides an optional AGENT_BROWSER_CONTENT_BOUNDARIES setting to wrap page content in delimiters to help the agent distinguish page data from instructions.
Capability inventory: The skill allows for full browser interaction, including navigation, form submission, file writing (screenshot, pdf, state save), and arbitrary JavaScript execution via the eval command.
Sanitization: The skill relies on opt-in security policies such as AGENT_BROWSER_ACTION_POLICY and AGENT_BROWSER_ALLOWED_DOMAINS to limit the scope of actions rather than active sanitization of the extracted text content.
[DATA_EXFILTRATION]: The skill manages sensitive data including cookies, session tokens, and credentials. Commands like agent-browser state save and agent-browser auth save store session tokens and credentials. The documentation notes that state files are plaintext by default, though it provides support for encryption using the AGENT_BROWSER_ENCRYPTION_KEY environment variable. The network har command can also capture sensitive data transmitted during interactions.
[DYNAMIC_EXECUTION]: The agent-browser eval command allows for the execution of arbitrary JavaScript within the browser context. While a core feature for automation, it enables dynamic code execution which could be exploited if the agent interpolates untrusted data into the evaluation string.
[COMMAND_EXECUTION]: The skill provides a powerful CLI interface for browser control, including navigation, element interaction, and session management. This grants the agent significant control over the local browser environment and any authenticated sessions.
[EXTERNAL_DOWNLOADS]: The agent-browser install command downloads the Chrome/Chromium browser to the local system. Additionally, the skill's setup instructions suggest installing the CLI tool itself via global package managers such as npm, brew, or cargo.

agent-browser