The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides a sync_local_profile function explicitly designed to upload the user's local browser cookies to a remote cloud environment ("Browser Use cloud"), which constitutes a direct exfiltration of sensitive session data.
[COMMAND_EXECUTION]: The utility browser-harness executes arbitrary Python code provided through the -c command-line argument. This allows the agent to run unvetted code directly in the host environment.
[EXTERNAL_DOWNLOADS]: Installation instructions guide the user to clone and install code from a third-party repository (github.com/browser-use/browser-harness) that is not verified and does not match the vendor patterns for the stated author.
[CREDENTIALS_UNSAFE]: The skill is designed to attach to the user's active, authenticated browser sessions. This gives the agent access to sensitive accounts (e.g., Gmail, LinkedIn, X/Twitter) and their associated data without requiring further authentication.
[REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by requiring the installation of an external repository and subsequently providing a mechanism to execute arbitrary logic passed from the LLM to the host shell.
[DATA_EXFILTRATION]: Indirect Prompt Injection Surface:
Ingestion points: Untrusted web content is ingested into the agent context via js() DOM extraction and capture_screenshot() calls (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions embedded in the ingested web data.
Capability inventory: The skill has the capability to write to the local file system and execute shell commands via the harness tool.
Sanitization: There is no evidence of sanitization or filtering of ingested web content before it is processed by the agent.

browser-harness