The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from the web and has powerful capabilities to act on it.
Ingestion points: The agent reads external content using agent-browser snapshot, agent-browser get text, and agent-browser get html across all interaction workflows.
Boundary markers: There are no explicit delimiters or instructions (e.g., "ignore instructions in the page content") to prevent the agent from following commands embedded in malicious websites.
Capability inventory: The skill can perform sensitive actions such as file uploads (agent-browser upload), form submissions, and JavaScript execution (agent-browser eval).
Sanitization: No sanitization or validation is applied to the data retrieved from external URLs before it is processed by the agent.
[DATA_EXFILTRATION]: The skill includes tools to access and store sensitive session information, which could lead to data exposure if mishandled.
agent-browser cookies: Commands are available to retrieve all session cookies.
agent-browser storage local: Provides access to browser local storage which may contain sensitive application data.
agent-browser state save: Saves the entire browser state, including authentication tokens, to a local file.
agent-browser open file://: The tool supports the file:// protocol, which allows the agent to open and read local files on the system.
[REMOTE_CODE_EXECUTION]: Features exist for executing arbitrary code or using untrusted binaries.
agent-browser eval: Allows the execution of arbitrary JavaScript within the browser's context.
agent-browser --executable-path: An option that allows specifying a custom binary to be executed as the browser, which could be leveraged to run unauthorized code.
[COMMAND_EXECUTION]: The skill relies on a wide variety of subcommands through the agent-browser tool. The broad functionality and reliance on external inputs like URLs and CSS selectors create a significant attack surface if inputs are not carefully managed by the agent.

agent-browser