The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in interaction-skills/profile-sync.md instructs the user or agent to execute a shell script directly from a remote URL using the high-risk pattern curl -fsSL https://browser-use.com/profile.sh | sh.
[DYNAMIC_EXECUTION]: The core functionality of the skill relies on session_daemon.py, which implements an execute function using Python's exec() and eval() primitives to run code received via a Unix domain socket in a persistent session namespace.
[CREDENTIALS_UNSAFE]: The script scripts/auth_cookie_audit.py is designed to directly access and query the Chrome browser's local cookie database (~/.config/browser-workspace/chrome/Default/Cookies). While it claims to only export HMAC-keyed metadata, the script itself has full read access to sensitive authentication tokens.
[COMMAND_EXECUTION]: The framework frequently uses subprocess.run, subprocess.Popen, and os.execve across various modules (e.g., session_client.py, managed_chrome.py) to manage the Chrome lifecycle, daemon processes, and runtime environments.
[EXTERNAL_DOWNLOADS]: The session_client.py script automatically downloads and installs dependencies from a remote Git repository (git+https://github.com/lalalic/browser-harness.git) during the runtime bootstrap process.
[INDIRECT_PROMPT_INJECTION]: The skill presents a significant attack surface for indirect prompt injection. It ingests untrusted data from web pages (via snapshots and JavaScript execution) and possesses powerful capabilities including file system access, network operations, and arbitrary command execution. There is a risk that an agent could be manipulated by instructions embedded in the websites it automates.

webhelm