The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content which could contain malicious instructions designed to subvert the agent's behavior. Ingested data is not sanitized before being returned to the agent context.
Ingestion points: The open, snapshot, and execute functions read content from arbitrary URLs, including HTML, text, and metadata.
Boundary markers: None identified. The skill returns raw text or JSON representations of the DOM to the agent.
Capability inventory: The skill possesses powerful capabilities including execute (arbitrary JavaScript execution), interact (file upload, form filling, clicking), screenshot, and close (video recording).
Sanitization: There is no evidence of filtering or sanitization of content retrieved from the web before it is processed by the agent.
[DATA_EXFILTRATION]: The interact function supports an upload action that accepts a list of file paths. This allows the agent to upload files from the local filesystem to a web form, which could be exploited to exfiltrate sensitive files if the agent is compromised by indirect injection.
[DATA_EXFILTRATION]: The execute function allows the execution of JavaScript within the browser context. This can be used to extract sensitive session data, such as document.cookie or localStorage content, as explicitly mentioned in the authentication documentation.
[DYNAMIC_EXECUTION]: The execute function enables the runtime execution of arbitrary JavaScript code strings provided as input. While this is a core feature for web automation, it provides a direct mechanism for executing logic received from untrusted sources if the agent is manipulated.
[COMMAND_EXECUTION]: The provided templates and documentation utilize shell commands (belt, infsh, jq, oathtool) via Bash to interact with the browser service, presenting a standard attack surface for command injection if user-supplied variables are not properly handled by the agent.

agent-browser