The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the 'codex' CLI tool with flags that explicitly bypass security boundaries: '--dangerously-bypass-approvals-and-sandbox' and '--skip-git-repo-check'. This instructs the tool to ignore its internal sandboxing and safety protocols.
[REMOTE_CODE_EXECUTION]: The script implements a mechanism to execute arbitrary JavaScript files. Users can provide a file path via the '--browser-script' argument or the 'BROWSER_SCRIPT' environment variable, which is then directly executed using 'node' via 'execFileSync'.
[PROMPT_INJECTION]: User-provided element descriptions ('target') are directly interpolated into the natural language prompt sent to the vision model. There is no sanitization or validation of this input, allowing for potential manipulation of the agent's instructions.
[DATA_EXFILTRATION]: The skill captures full screenshots of the browser viewport and saves them to the local filesystem. These images, which may contain sensitive user data or credentials, are then passed to an external CLI tool for processing.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of a global NPM package '@openai/codex'. This is an external dependency that must be managed by the user and represents a potential supply-chain risk.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: Browser screenshots are captured via 'agbrowse screenshot' in 'vision-click.mjs'.
Boundary markers: Absent. The vision prompt in 'vision-core.mjs' does not use delimiters or instructions to ignore text within the screenshot.
Capability inventory: The skill can execute shell commands via 'execFileSync', run arbitrary scripts, and perform mouse clicks on the user's screen.
Sanitization: Absent. The untrusted content from the screenshot is processed directly by the vision model without filtering.

vision-click