The Agent Skills Directory

[DYNAMIC_EXECUTION]: The evaluate tool (src/tools/evaluate.rs) allows the agent to execute arbitrary JavaScript code within the browser context, providing a mechanism for runtime code generation and execution.
[CREDENTIALS_UNSAFE]: The skill includes specialized tools for managing browser session state (src/tools/cookies.rs and src/tools/local_storage.rs). These tools allow the extraction of authentication tokens and session identifiers, which are explicitly described in the documentation (SKILL.md) as a 'Cookie Heist' recipe for session reuse.
[INDIRECT_PROMPT_INJECTION]: The skill creates a high-risk surface for indirect prompt injection. It ingests untrusted data from web pages via the snapshot, markdown, and extract tools and possesses powerful interaction capabilities (click, input, navigate, and evaluate). Malicious content on a website could attempt to trigger these tools to perform actions on behalf of the user.
Ingestion points: src/tools/markdown.rs, src/tools/extract.rs, and src/tools/snapshot.rs (processes raw HTML and text from external URLs).
Boundary markers: The skill uses Markdown and YAML formatting for data presentation but lacks explicit instructions to the agent to ignore embedded commands within the extracted content.
Capability inventory: Full browser control including click, input, navigate, evaluate (JS execution), and session management (cookies, local_storage).
Sanitization: Uses Mozilla's Readability.min.js to filter page content, which reduces but does not eliminate the risk of processing malicious instructions.
[COMMAND_EXECUTION]: The annotate tool (src/tools/annotate.rs) reads from hardcoded local filesystem paths (/System/Library/Fonts/Helvetica.ttc or /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf) to load fonts for image processing.
[EXTERNAL_DOWNLOADS]: The installation instructions in SKILL.md point to a third-party Homebrew tap and Cargo package (rknoche6/tap/fast-browser-use), which are external to the primary platform and the claimed author's infrastructure.
[DATA_EXFILTRATION]: The combined capability of reading sensitive session data (cookies) and writing to the local filesystem (screenshots and session JSON files like auth.json) provides a pathway for harvesting and exfiltrating user credentials.

fast-browser-use