The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on arbitrary web content, creating an ingestion surface for untrusted data that could contain malicious instructions.
Ingestion points: The agent retrieves web page information and DOM structures through new_tab, goto_url, and the js(...) helper. (SKILL.md)
Boundary markers: The instructions lack clear delimiters or warnings to prevent the agent from following instructions embedded within the processed web content.
Capability inventory: The skill possesses high-privilege capabilities including arbitrary JavaScript execution, local Python execution via the harness CLI, and the management of remote browser daemons. (SKILL.md)
Sanitization: There is no evidence of sanitization or filtering applied to external content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill utilizes several forms of dynamic code execution to achieve its automation goals.
It executes Python code provided via heredocs through the browser-harness CLI. (SKILL.md)
It dynamically loads "domain skills" and task-specific helpers from computed paths within the $BH_AGENT_WORKSPACE directory based on the site being visited. (SKILL.md)
It allows for direct execution of JavaScript in the browser context via the js(...) function. (SKILL.md)
[EXTERNAL_DOWNLOADS]: The skill references external resources on GitHub for installation, interaction guidelines, and setup documentation.
It points to github.com/browser-use/browser-harness for installation and interaction skills. (SKILL.md)
[COMMAND_EXECUTION]: The skill interacts with the system and remote services using the browser-harness CLI tool to manage browser daemons and authentication. (SKILL.md)

browser-harness