The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate and interact with arbitrary web pages, which are untrusted sources of data. Malicious content on these pages could attempt to subvert the agent's instructions.
Ingestion points: Web content is ingested via superset browser navigate, eval, console, and cdp commands, as well as browser-use interactions.
Boundary markers: No specific delimiters or "ignore" instructions are used when processing content from the web pages.
Capability inventory: The agent has high-privilege capabilities including shell access (Bash), network operations (curl), file writes (screenshot --out), and remote publishing (superset pages publish).
Sanitization: There is no evidence of sanitization or filtering of data retrieved from web pages before it is processed or used in subsequent commands.
[DATA_EXFILTRATION]: Several commands facilitate the movement of sensitive data.
The superset browser import-login command copies authentication cookies from local browsers (Chrome, Arc, Edge, Brave, etc.) into the agent's environment.
The superset pages publish command uploads local files (screenshots) to a remote Superset workspace, which may inadvertently include sensitive session data or personal information visible in the browser.
The superset browser cdp command generates a WebSocket URL that includes an embedded authentication token.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the browser-use package using uv tool install browser-use and may suggest using uvx for ephemeral execution of external code.
[DYNAMIC_EXECUTION]: The skill makes extensive use of dynamic code execution at runtime.
superset browser eval and CDP Runtime.evaluate are used to execute arbitrary JavaScript within the browser context.
browser-use executes Python code provided via shell heredocs to perform complex automation tasks.
[PRIVILEGE_ESCALATION]: The import-login functionality on macOS specifically reads the browser's Keychain key, which is a protected system secret. While it requires a system-level user prompt, it represents an escalation of access to the user's saved credentials.

browser