The Agent Skills Directory

[DYNAMIC_EXECUTION]: The evaluate tool enables the execution of arbitrary JavaScript code within the browser's context. This is an intended feature for advanced automation but constitutes a dynamic execution surface if the AI agent is manipulated by untrusted content.
[DATA_EXFILTRATION]: The skill provides specialized tools to retrieve sensitive browser data, including cookies and local storage. This allows for session state maintenance but could be misused to extract authentication tokens if an agent is poorly directed.
[COMMAND_EXECUTION]: The screenshot and annotate tools have the capability to write files to the local filesystem at paths specified by the user or agent, which could lead to unauthorized file creation if not restricted by the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill has a high vulnerability surface for indirect prompt injection as it ingests untrusted web content and provides the agent with powerful interaction capabilities.
Ingestion points: Untrusted data enters the context through the navigate, extract, and markdown tools (found in src/tools/).
Boundary markers: Absent; the skill does not wrap extracted content in explicit delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill possesses the ability to execute JavaScript, fill forms, click elements, and access session cookies.
Sanitization: The skill employs basic YAML escaping for value content in its ARIA snapshots (src/dom/yaml.rs) to prevent page content from breaking the structural representation for the AI.
[OBFUSCATION]: The skill includes a minified version of the Mozilla Readability library (src/tools/Readability.min.js) for content extraction.
[EXTERNAL_DOWNLOADS]: Installation instructions in SKILL.md reference a custom Homebrew tap and Cargo package (rknoche6/fast-browser-use), which are external dependencies managed by the author.

rust-browser-pilot