The Agent Skills Directory

[DYNAMIC_EXECUTION]: The run_javascript tool implementation in background/tools.ts uses new Function(args.code as string) to create an executable function from a string. This string is generated by the AI model during the agent loop. Executing AI-generated strings as code is a high-risk pattern that allows for arbitrary code execution within the browser context.
[INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection attacks where malicious web content could influence the agent's behavior.
Ingestion points: The read_page_content tool in content/tools/executor.ts extracts raw text and HTML from active browser tabs and provides it to the AI model.
Boundary markers: The agent loop (agent/loop.ts) and prompt construction do not show usage of structured boundary markers or explicit instructions to ignore embedded commands within the ingested page data.
Capability inventory: The extension possesses powerful capabilities including run_javascript (arbitrary code execution), take_screenshot (visual data capture), and DOM manipulation tools (click_element, type_text).
Sanitization: There is no evidence of sanitization or filtering of page content before it is passed to the Gemma 4 model.
[EXTERNAL_DOWNLOADS]: The skill downloads AI model weights from Hugging Face's official repositories (e.g., onnx-community/gemma-4-E2B-it-ONNX). These downloads are performed using the @huggingface/transformers library.
[COMMAND_EXECUTION]: The service worker utilizes chrome.scripting.executeScript to run code within the context of web pages. When combined with the AI-driven run_javascript tool, this allows the agent to perform complex, unvalidated actions on behalf of the user in any open tab.

gemma-gem-browser-ai