The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's state management system (commands like state save and --session-name) stores browser cookies and session tokens in plaintext files on the local disk by default. While encryption is supported, it is an opt-in feature requiring manual setup of the AGENT_BROWSER_ENCRYPTION_KEY environment variable.
[DATA_EXFILTRATION]: Multiple commands allow for the extraction of sensitive information, including reading the system clipboard (clipboard read), accessing local files via the file:// protocol (--allow-file-access), and connecting to the user's active Chrome instance to extract session data and cookies (--auto-connect).
[COMMAND_EXECUTION]: The eval command enables the execution of arbitrary JavaScript within the browser context. The documentation encourages using Base64 encoding or stdin to pass scripts, which can be used to obscure malicious intent from simple log or prompt analysis.
[EXTERNAL_DOWNLOADS]: The skill requires downloading a browser binary (Chrome/Chromium) at runtime via the agent-browser install command.
[PROMPT_INJECTION]: The skill acts as a major vector for indirect prompt injection by processing untrusted external web content. It includes an opt-in safety feature (AGENT_BROWSER_CONTENT_BOUNDARIES) to mark tool output, but this is not active by default. Ingestion points: Web pages processed via open, snapshot, and get text (SKILL.md, references/snapshot-refs.md). Boundary markers: Opt-in AGENT_BROWSER_PAGE_CONTENT markers are available but disabled by default. Capability inventory: eval, fill, click, network route, clipboard write, and state save (references/commands.md). Sanitization: No automatic sanitization is performed on ingested page content before it is returned to the agent context.

agent-browser