The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a framework for web browser automation, which inherently involves the ingestion and processing of untrusted content from external websites.
Ingestion points: The library ingests HTML, page text, and screenshots from arbitrary URLs via the Agent and Browser classes as described in references/agent.md and references/browser.md.
Boundary markers: While the documentation promotes the use of sensitive_data placeholders to prevent secret exposure to the LLM, it does not explicitly instruct on the use of delimiters to isolate untrusted web content from agent instructions.
Capability inventory: The library includes capabilities for file system access (write_file, read_file), JavaScript execution (evaluate), and system process management, which could be targeted by malicious content embedded in web pages.
Sanitization: The provided documentation does not detail automated sanitization or filtering of ingested web content before it is passed to the language model.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The documentation in references/quickstart.md provides a setup command that downloads and executes a shell script: curl -fsSL https://browser-use.com/profile.sh | sh. This is presented as a method to synchronize browser profiles with the project's cloud infrastructure. Additionally, the recommended use of uvx involves dynamic download and execution of the browser-use package.
[DYNAMIC_EXECUTION]: Documentation provides examples of JavaScript execution via page.evaluate() in references/actor.md and the use of the subprocess module to manage browser processes in references/examples.md.

open-source