The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content which creates a surface for indirect prompt injection attacks.
Ingestion points: The skill ingests external data via agent-browser snapshot, agent-browser get text, and agent-browser get html (SKILL.md).
Boundary markers: The instructions do not define boundary markers or delimiters to separate untrusted web content from agent instructions.
Capability inventory: The agent has the capability to perform actions based on processed data using agent-browser click, agent-browser fill, and agent-browser open (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from web pages.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx @claude-flow/cli in its examples for memory and hook integration, which involves downloading and executing code from the npm registry.
[COMMAND_EXECUTION]: The skill's primary functionality is built upon executing shell commands through the agent-browser CLI tool and the @claude-flow/cli via npx.
[DATA_EXFILTRATION]: The skill features session management capabilities, specifically agent-browser state save auth.json and agent-browser state load auth.json. These files typically contain sensitive authentication tokens and cookies. While used for legitimate session persistence, they represent a potential data exposure risk if the environment is compromised.

browser