The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation includes examples using hardcoded credentials, specifically the command agent-browser set credentials admin secret.
[DATA_EXFILTRATION]: The skill provides tools for accessing and extracting sensitive information such as browser cookies (agent-browser cookies), local storage (agent-browser storage), and system clipboard data (agent-browser clipboard read). It also facilitates saving session state to local files (agent-browser state save ./auth.json).
[DYNAMIC_EXECUTION]: The eval command allows for the execution of arbitrary JavaScript within the browser context, including support for Base64 encoded scripts via the -b flag.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface for indirect prompt injection by ingesting untrusted data from the web.
Ingestion points: Untrusted data enters the agent context through commands like snapshot, get text, get html, and console which retrieve content directly from external, potentially malicious web pages.
Boundary markers: The instructions lack explicit boundary markers or guidance for the agent to ignore embedded commands within the retrieved web content.
Capability inventory: The skill possesses extensive capabilities that could be abused if an injection is successful, including file writes (screenshot, pdf, state save), network operations (open, network route), and dynamic code execution (eval).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from web pages before it is processed by the agent.

agent-browser-automation