The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the agent-browser eval command to execute arbitrary JavaScript code within the browser context. This includes a documented method for executing Base64-encoded strings (eval -b) to circumvent shell quoting limitations, which constitutes a form of code obfuscation.
[DATA_EXFILTRATION]: Instructions for using the --allow-file-access flag are provided, which permits the browser to access local system files via file:// URLs. This capability, combined with the tool's ability to interact with external websites and upload files, presents a risk of sensitive data exposure and exfiltration.
[PROMPT_INJECTION]: The skill's primary function involves processing and interacting with content from arbitrary external websites, exposing the agent to indirect prompt injection. Malicious instructions hidden in a webpage's DOM or accessibility tree could override agent behavior.
Ingestion points: agent-browser snapshot, get text, and general web navigation.
Boundary markers: Absent; untrusted content is not clearly delimited from agent instructions.
Capability inventory: File system access, network interaction, and JavaScript execution.
Sanitization: None; the skill does not perform validation or escaping of external content before processing.

browser-qa