The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web through navigation, snapshots, and text extraction commands. This exposes the agent to indirect prompt injection attacks where malicious web content could attempt to override agent instructions. The skill provides an opt-in mechanism (AGENT_BROWSER_CONTENT_BOUNDARIES) to help the LLM distinguish between tool output and untrusted content.
Ingestion points: Commands such as agent-browser open, agent-browser snapshot, and agent-browser get text (documented in SKILL.md and references/commands.md).
Boundary markers: The skill documentation explicitly recommends using AGENT_BROWSER_CONTENT_BOUNDARIES to wrap page-sourced output in markers.
Capability inventory: The CLI supports file system writes (screenshot, pdf, state save), arbitrary JavaScript execution in the browser (eval), and browser-level network operations.
Sanitization: Sanitization is handled via opt-in boundary markers and domain allowlisting.
[DYNAMIC_EXECUTION]: The eval command enables the execution of arbitrary JavaScript within the browser context. It supports input via stdin and Base64 encoding to avoid shell escaping issues, which also provides a path for executing encoded scripts. This is a primary function of the tool but allows for complex, dynamic code execution during a session.
[CREDENTIALS_UNSAFE]: The skill manages sensitive authentication data, including session cookies and localStorage tokens. The state save command stores session tokens in plaintext by default unless an AGENT_BROWSER_ENCRYPTION_KEY is provided. While the documentation warns users to add these files to .gitignore, the default behavior poses a risk of credential exposure if managed improperly.
[COMMAND_EXECUTION]: The skill relies on the agent-browser CLI to perform high-privilege browser actions, including network routing, request interception (network route), and accessing local files via file:// URLs (when --allow-file-access is enabled).

agent-browser