The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from arbitrary external websites, creating a surface for indirect prompt injection attacks where website content could attempt to override agent instructions.\n
Ingestion points: Web page content is ingested into the agent's context through functions like snapshot, execute, and screenshot as defined in SKILL.md and references/commands.md.\n
Capability inventory: The skill possesses significant capabilities that could be targeted by an injection, such as clicking elements, filling forms, uploading files, and executing arbitrary JavaScript (SKILL.md, references/commands.md).\n
Boundary markers: The provided automation templates (e.g., templates/capture-workflow.sh) do not implement boundary markers or specific instructions to isolate or ignore potential commands within fetched web data.\n
Sanitization: There is no explicit sanitization of the DOM content or text extracted from web pages before it is presented to the agent.\n- [DYNAMIC_EXECUTION]: The execute function enables the execution of arbitrary JavaScript code within the browser context, which can be used to manipulate page state or extract information (references/commands.md).\n- [COMMAND_EXECUTION]: The skill instructions and templates frequently execute shell commands using the belt and infsh CLI tools to perform browser actions (SKILL.md, templates/authenticated-session.sh).\n- [DATA_EXFILTRATION]: Documentation within the skill provides examples for extracting sensitive session data, such as document.cookie, and supports uploading local files to remote forms (references/authentication.md, SKILL.md).

agent-browser