The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill exposes commands like browser-use eval "js code" and browser-use python "code" which allow the agent to execute arbitrary JavaScript within the browser context or Python code in a persistent session.
[DATA_EXFILTRATION]: Multiple commands facilitate the access and extraction of sensitive data:
browser-use cookies get and browser-use cookies export allow retrieving and saving browser session cookies.
browser-use screenshot captures visual data from the page.
browser-use tunnel <port> utilizes Cloudflare's well-known trycloudflare.com service to expose local ports to the public internet, which can be used to bypass firewalls or expose sensitive local services.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection:
Ingestion points: Data from remote websites enters the agent context via browser-use state, browser-use get html, and browser-use get text (SKILL.md).
Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions in the processed web content.
Capability inventory: The agent has access to arbitrary code execution (python, eval), file system operations (upload, cookies export), and network exposure (tunnel).
Sanitization: There is no mention of sanitizing or escaping the text/HTML extracted from the browser before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on the browser-use CLI tool to perform all actions, which involves executing bash commands with various arguments, including URLs and file paths.

remote-browser