The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external content from the web through snapshots and scraping operations, creating an indirect prompt injection surface. An attacker-controlled website could include instructions designed to influence the agent's subsequent behavior.
Ingestion points: Web content retrieved via browser(action="snapshot") and browser(action="act", kind="evaluate", ...).
Boundary markers: None specified in the instructions to distinguish between page content and agent instructions.
Capability inventory: Browser automation control, local file uploads (upload), and PDF generation (pdf) to local paths.
Sanitization: No explicit sanitization or filtering of web content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The evaluate action allows the execution of arbitrary JavaScript code within the browser context. While restricted to the browser environment, this facilitates dynamic code execution based on page content or user input.
[DATA_EXFILTRATION]: The skill supports file uploads (upload) and exporting pages to PDF (pdf) using local system paths. If misused, these features could be directed to access sensitive local files or save browser-retrieved data to specific system locations.

agent-browser-assistant