The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to interact with and extract data from any website (ingestion points in SKILL.md and references/commands.md via snapshot, get text, and get html commands). There are no explicit boundary markers or sanitization steps mentioned to prevent the agent from obeying instructions embedded in web content. The agent possesses broad capabilities, including file writing (screenshots/PDFs), network operations, and dynamic code execution (eval), which could be leveraged if the agent is influenced by malicious web content.- [CREDENTIALS_UNSAFE]: Several files, including references/authentication.md and templates/authenticated-session.sh, describe workflows for saving and loading browser state files (e.g., auth-state.json) that store session tokens in plaintext. While the documentation recommends encryption and provides an authentication vault, the default templates utilize environment variables like APP_PASSWORD and file-based state persistence, which may lead to accidental exposure if not managed securely.- [DYNAMIC_EXECUTION]: The agent-browser eval command, documented in references/commands.md, allows for the execution of arbitrary JavaScript within the browser context. The support for a -b/--base64 flag facilitates the execution of encoded scripts, which could be used as a vector to obfuscate malicious logic from basic static analysis.- [COMMAND_EXECUTION]: The skill relies on the agent-browser CLI to perform all browser automation tasks. This provides the agent with full control over a browser instance, including the ability to manipulate network traffic, intercept requests, and access local files via the file:// protocol.- [EXTERNAL_DOWNLOADS]: The agent-browser skills get command is used to download and load additional specialized workflow content and skills from a remote source at runtime, representing a dynamic content loading mechanism.

agent-browser