The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user to download and execute a script from https://cli.inference.sh using the curl | sh pattern. This allows arbitrary code execution from an external source without verification of the script content before execution in the local environment.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to run local browser automation via agent-browser and cloud-based automation via the infsh CLI. It also suggests installing global system dependencies via npm install -g appium.
[DATA_EXFILTRATION]: The agent-browser tool includes an --allow-file-access flag which grants the browser permission to read files from the local filesystem (e.g., file:///path/to/document.pdf). This creates a high risk of local data exposure if the agent is directed to sensitive files or navigates to untrusted websites that could exploit this access to read local data.
[PROMPT_INJECTION]: As a browser automation skill, it inherently processes untrusted data from external websites. The snapshot operations ingest webpage content (DOM elements and text) directly into the agent's context. This presents a surface for indirect prompt injection where malicious instructions embedded in a webpage could manipulate the agent's behavior.
Ingestion points: agent-browser open, infsh ... open, and subsequent snapshot operations in SKILL.md.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands within webpage content are provided.
Capability inventory: The skill utilizes the Bash tool, providing broad system access including file system interaction, network capabilities, and browser control.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the extracted webpage content (text, attributes, or metadata) before it is processed by the agent.

browser-automation