The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides browser-use eval "js code" to execute arbitrary JavaScript within the browser context and browser-use python "statement" to execute arbitrary Python code. The Python environment has access to internal session objects (browser._session) and the BrowserSession manager.
[DATA_EXFILTRATION]: Contains built-in commands for extracting browser cookies (browser-use cookies get, browser-use cookies export <file>) and the ability to capture full-page screenshots. These features can be misused to exfiltrate session tokens and sensitive information displayed on web pages.
[COMMAND_EXECUTION]: Provides automated setup for Cloudflare tunnels via browser-use tunnel <port>. While useful for development, this allows exposing local services to the public internet, which could be leveraged for unauthorized access or data exfiltration if misused.
[CREDENTIALS_UNSAFE]: The skill encourages the use of real user Chrome profiles (via --profile "Name" or connect) which provides the agent with access to the user's saved logins, cookies, and browsing history. It also manages a cloud API key (browser-use cloud login <api-key>) stored locally.
[REMOTE_CODE_EXECUTION]: While not directly downloading and piping to a shell, the browser-use profile update command downloads and updates binary executables, which is a form of remote code retrieval and update mechanism.

browser-use