The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill features an execute function that allows the AI agent to run arbitrary JavaScript code within the context of the browser session. This capability can be used to manipulate the Document Object Model (DOM), interact with page elements, or access browser-level data.
[DATA_EXFILTRATION]: The documentation and templates provide instructions and examples for extracting sensitive information, specifically browser cookies via document.cookie and full page text, which could lead to session hijacking or unauthorized data collection if misused.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it retrieves and processes untrusted data from external websites. Malicious instructions placed on a web page could be ingested by the agent and lead to unauthorized actions.
Ingestion points: The open, snapshot, and execute functions (documented in SKILL.md and references/commands.md) fetch content from external URLs.
Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present in the skill prompts.
Capability inventory: The skill possesses the ability to perform web interactions (click, fill), file uploads (upload), and JavaScript execution (execute).
Sanitization: There is no evidence of sanitization or filtering of the fetched web content before it is processed by the agent.
[COMMAND_EXECUTION]: Several shell script templates (templates/authenticated-session.sh, templates/capture-workflow.sh, templates/form-automation.sh) are provided that execute the infsh CLI tool and other system utilities to automate browser workflows.

agent-browser