The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of an external global NPM package agent-browser followed by an additional installation command agent-browser install to fetch binaries or drivers. These resources originate from an unverified third-party source.
[DYNAMIC_EXECUTION]: The tool relies on a remote fetching mechanism (agent-browser skills get <name>) to retrieve workflows, command references, and specialized instructions at runtime. This allows the skill's behavior to change based on remote content that is not visible or audited within the provided skill file.
[COMMAND_EXECUTION]: The skill utilizes Bash commands to execute the agent-browser CLI, enabling broad programmatic control over the host system's web browser and connected services.
[INDIRECT_PROMPT_INJECTION]: The primary function of the skill is to interact with and extract data from external websites and communication platforms, creating a significant attack surface for indirect prompt injection.
Ingestion points: The agent ingests untrusted data from web page accessibility trees, DOM content, and Slack conversation histories (via skills get slack).
Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the ingested data mentioned in this discovery stub.
Capability inventory: The skill possesses powerful capabilities including form filling, button clicking, screenshot capture, Slack message transmission, and automation of local Electron apps like VS Code and Discord.
Sanitization: The skill lacks explicit sanitization or verification steps for data retrieved from the browser before it is processed by the agent.
[PRIVILEGE_ESCALATION]: The skill targets high-value local applications (Electron apps like VS Code, Slack, and Discord) and cloud environments (AWS Bedrock, Vercel Sandboxes), providing an agent with potential access to source code, private communications, and cloud infrastructure.

agent-browser