The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because its core function is to browse and snapshot untrusted external web content. A malicious website could serve content designed to be interpreted as instructions when snapshotted by the agent.
Ingestion points: agent-browser open and snapshot -i are used throughout SKILL.md, references/scraping.md, and the provided templates to bring external content into the agent's context.
Boundary markers: The skill does not implement or recommend using boundary markers or 'ignore' instructions when presenting web snapshots to the agent.
Capability inventory: The agent has access to the Bash tool and the agent-browser CLI, enabling file system access, network operations, and dynamic script execution.
Sanitization: No sanitization or filtering of the scraped web content (accessibility tree/interactive elements) is performed before it is processed by the agent.
[COMMAND_EXECUTION]: The skill utilizes a powerful CLI tool for browser control. It specifically documentation features for dynamic JavaScript evaluation (agent-browser eval), including an option (-b) to execute Base64-encoded strings (as seen in references/commands.md). This capability can be used to execute arbitrary logic in the browser context and can be leveraged by an attacker to obfuscate malicious scripts.
[CREDENTIALS_UNSAFE]: Documentation in references/proxy-support.md and references/authentication.md provides examples of hardcoding credentials in URLs (e.g., http://username:password@proxy...) and setting sensitive session tokens via command-line arguments. This practice can result in secrets being leaked into shell history, process lists, or logs.
[DATA_EXFILTRATION]: The skill facilitates the storage of sensitive browser state, including cookies and session tokens, in local JSON files (state save). While the documentation mentions optional encryption, the handling of these portable artifacts represents a risk for data exposure if the environment is compromised or if the agent is manipulated via injection.

agent-browser