The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is primarily designed to fetch, scrape, and process content from external, untrusted websites, which is the primary vector for indirect prompt injection.
Ingestion points: URLs and task descriptions are passed to tools in examples/scrape-agent.ts, examples/langchain-browser-tool.ts, and references/integrations/crewai.md.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the results from browser sessions as untrusted or potentially malicious data.
Capability inventory: The agent is granted extensive capabilities including full browser control (navigation, clicking, typing), network access, and file system interaction.
Sanitization: The skill performs basic truncation of content (e.g., slice(0, 10000)) but does not implement structural sanitization, filtering, or escaping of the scraped web content.
[DATA_EXFILTRATION]: The skill includes a 'File Upload and Download' pattern (references/patterns/files.md) that provides code to read files from the local filesystem (fs.readFileSync) and upload them to a remote cloud browser session. While intended for form submissions, this creates a capability that could be misused to exfiltrate sensitive local files (e.g., SSH keys or environment files) if an agent is manipulated via prompt injection.
[COMMAND_EXECUTION]: The skill instructions and integration references include shell command execution for setting up the environment and bridging language runtimes.
Evidence: SKILL.md instructs the agent to run npm install or yarn add for the @testmuai/browser-cloud package if it is missing. references/integrations/crewai.md provides a pattern using subprocess.run to execute a Node.js bridge script via npx ts-node.

browser-cloud