The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to ingest and process data from external websites.
Ingestion points: Untrusted content enters the agent context through agent-browser snapshot, get text, get html, and console log commands in SKILL.md.
Boundary markers: Absent. There are no instructions or delimiters used to separate untrusted web content from the agent's internal logic.
Capability inventory: The agent has high-privilege capabilities including arbitrary JavaScript execution (eval), local file access (file://), and the ability to write files (screenshots, PDFs, and video recordings) to the local system.
Sanitization: Absent. The skill provides no mechanisms for sanitizing or validating the content retrieved from web pages before processing it.
[COMMAND_EXECUTION]: The agent-browser eval command allows for the dynamic execution of arbitrary JavaScript within the browser context. This provides an extensive attack surface for executing malicious scripts if the agent is influenced by injected instructions.
[DATA_EXFILTRATION]: The agent-browser open command explicitly supports the file:// protocol. This could be exploited to access sensitive local system files (e.g., configuration files or SSH keys) if a malicious URL is provided to the agent.
[CREDENTIALS_UNSAFE]: Plaintext credentials are handled unsafely in SKILL.md via the set credentials command and the --proxy option, which accept usernames and passwords as command-line arguments, potentially exposing them in system logs or process lists.

agent-browser