The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external websites, which are untrusted sources. This creates a surface for indirect prompt injection where a malicious website could provide instructions that override agent behavior. * Ingestion points: Website content is read through tools such as browser_snapshot, browser_get_text, browser_get_value, browser_get_attr, browser_get_requests, browser_get_responses, and browser_get_console_logs as detailed in SKILL.md. * Boundary markers: The instructions include guidelines for the agent to use AskUserQuestion before performing data-changing actions, but they do not define specific delimiters or 'ignore' instructions for the ingested website content itself. * Capability inventory: The skill possesses significant capabilities including browser interaction (browser_click, browser_type), navigation, and the ability to save session data to the local file system (browser_save_session). * Sanitization: No explicit sanitization or filtering of external website content is described in the provided files.
[DATA_EXFILTRATION]: The skill includes tools to access, export, and save sensitive browser information, which could be misused to harvest credentials or session tokens. * Evidence: Tools like browser_get_cookies, browser_export_session, and browser_save_session allow the agent to retrieve and store browser state, including authentication data, to local files.
[DYNAMIC_EXECUTION]: The skill supports the execution of dynamic code within the browser context, which is a powerful capability that could be leveraged for malicious activity if the agent is compromised. * Evidence: The RunScript node in docs/patterns/browser.md and the browser_eval functionality mentioned in SKILL.md allow for arbitrary JavaScript execution.
[COMMAND_EXECUTION]: The skill uses various MCP tools to interact with the browser environment and perform actions on websites. * Evidence: Tools such as browser_click, browser_type, browser_select, and browser_navigate allow the agent to execute commands that change the state of the target web applications.

exploring-browser