The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process content from a web browser, which is an untrusted external source. Maliciously crafted web pages could contain instructions intended to influence the agent's behavior.
Ingestion points: Browser-extracted content including page titles, links, and text fetched via agent-browser commands (SKILL.md).
Boundary markers: None implemented in the discovery or execution scripts.
Capability inventory: Local file access, network communication with localhost, and subprocess execution (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering of content extracted from the browser before it is potentially used in subsequent prompts.
[COMMAND_EXECUTION]: The skill uses the subprocess module to interact with the agent-browser CLI tool. While this is the intended mechanism for browser automation, it relies on an environment variable AGENT_BROWSER_BIN which defines the binary to be executed.
[DYNAMIC_EXECUTION]: Through the agent-browser dependency, the skill enables the execution of arbitrary JavaScript within the browser context using the execute command. This is standard functionality for browser automation but constitutes a dynamic execution surface.
[DATA_EXFILTRATION]: The skill reads the DevToolsActivePort file from the user's home directory (e.g., ~/Library/Application Support/Tabbit/DevToolsActivePort) to obtain the debugging port. This is a legitimate operation for a browser connector but involves accessing local application configuration files.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged the query to http://127.0.0.1:{port}/json/version as a remote code execution pattern. However, this is evaluated as low risk because the request is restricted to the local loopback address to communicate with a trusted local browser instance.

tabbit-browser-devtools-skill