The Agent Skills Directory

[COMMAND_EXECUTION]: The eval command allows the agent to execute arbitrary JavaScript within the browser. This capability includes support for base64-encoded scripts via the -b flag, which acts as an obfuscation layer to hide potentially malicious logic from inspection.\n- [DATA_EXFILTRATION]: Local system file access is possible through the file:// protocol when the --allow-file-access flag is enabled. This allows the ingestion of sensitive local data into the agent context, which can subsequently be exfiltrated through the browser session.\n- [CREDENTIALS_UNSAFE]: Authentication states, including session cookies and localStorage data, are saved in plaintext state files (e.g., auth.json) by default. This poses a high risk of credential exposure if these files are accessed by unauthorized processes or users.\n- [REMOTE_CODE_EXECUTION]: The skill includes functionality to download and update browser binaries (agent-browser install) and automation drivers (appium driver install xcuitest) from external remote sources at runtime.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from websites via commands like agent-browser snapshot and get text. While it offers optional boundary markers (--content-boundaries), they are not enforced. The skill possesses high-privilege capabilities such as file writes (download), network operations, and code execution (eval) that could be abused if the agent follows malicious instructions embedded in web content.

agent-browser