The Agent Skills Directory

[COMMAND_EXECUTION]: The skill enables the execution of arbitrary shell commands and Playwright scripts within remote browser virtual machines through the kernel browsers process exec and kernel browsers playwright execute commands. These operations occur in an isolated cloud environment, but agents should ensure that inputs used to build these commands are validated to prevent command injection within the VM.
[PRIVILEGE_ESCALATION]: The kernel browsers process exec command supports an --as-root flag, allowing for administrative access inside the remote browser VM. This increases the potential impact of any malicious code executed within that environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and retrieve data from external web pages, presenting a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via browser automation results (playwright execute), application logs (kernel logs), and visual captures (screenshot).
Boundary markers: The instructions do not define specific delimiters or warnings to ignore embedded instructions within the ingested data.
Capability inventory: The skill provides extensive capabilities including remote process execution, filesystem management, and network configuration via the Kernel CLI.
Sanitization: There are no documented mechanisms for sanitizing or validating content retrieved from external sources before it is processed by the agent.
[CREDENTIALS_UNSAFE]: The documentation references sensitive local file paths for authentication, such as the ~/.ssh/id_ed25519 example for SSH access. While these are legitimate use cases for the tool, agents must ensure that local credentials are not inadvertently exposed or exfiltrated during operation.
[DYNAMIC_EXECUTION]: The skill facilitates the execution of dynamically generated scripts (Playwright/TypeScript and shell) by passing them as arguments to the CLI tool, which then runs them inside the remote VM environment.

kernel-cli