The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves navigating and extracting data from arbitrary websites via run_browser_agent and run_deep_research, which inherently exposes the agent to untrusted external content containing potentially malicious instructions.
Ingestion points: Web pages and search results processed during automation or research tasks as described in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety guidelines for the agent to differentiate between user-provided tasks and untrusted content found on the web.
Capability inventory: The agent can interact with web elements, fill forms, write research reports to the file system, and save persistent automation skills.
Sanitization: No explicit sanitization or filtering of web-based content is mentioned in the skill definition.
[DYNAMIC_EXECUTION]: Through the learn and save_skill_as parameters in run_browser_agent, the agent discovers and extracts API patterns and navigation logic from live websites to generate new, reusable skills. This process dynamically creates execution logic based on untrusted external interactions.
[PERSISTENCE]: The skill uses a dedicated directory (~/.config/browser-skills/) to store learned automation behaviors. The tools skill_list, skill_get, and skill_delete manage these persistent artifacts across sessions.
[PRIVILEGE_ESCALATION]: The run_deep_research tool includes a save_to_file parameter, granting the agent the capability to write markdown research reports to user-defined local file paths. Without strict path validation, this could potentially be used to write data outside of intended directories.

browser-use