The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides an eval command that allows the agent to execute arbitrary JavaScript within the browser context. While the documentation provides a benign Base64-encoded example, this capability allows for the execution of complex, runtime-generated logic.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external websites through commands like snapshot and get text, creating a significant attack surface for indirect prompt injection.
Ingestion points: agent-browser open, snapshot, get text (found in SKILL.md and templates/capture-workflow.sh).
Boundary markers: None explicitly implemented within the skill instructions to separate web content from system instructions.
Capability inventory: The skill possesses extensive browser control capabilities including click, fill, eval, and state save.
Sanitization: There is no mention of sanitizing or filtering the scraped text before it is returned to the agent context.
[DATA_EXFILTRATION]: The skill manages sensitive browser data through state save and state load commands, which store cookies, local storage, and session tokens in JSON files. The eval command also allows reading browser secrets via JavaScript. If an agent is influenced by malicious external data, these capabilities could be misused to exfiltrate session credentials.
[COMMAND_EXECUTION]: The skill enables interaction with the browser via the agent-browser CLI, which includes capabilities like accessing local files using file:// protocols and uploading files from the local system.

agent-browser