The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection. It is designed to navigate to arbitrary URLs and extract page content (text, structure, and snapshots), which is then processed by the AI agent. A malicious website could embed instructions designed to manipulate the agent's behavior.
Ingestion points: Multiple commands including agent-browser open, agent-browser snapshot, and agent-browser get text (as seen in SKILL.md and templates/capture-workflow.sh) ingest untrusted data from the web.
Boundary markers: The skill does not provide delimiters or instructions to the agent to ignore potential commands embedded within retrieved web content.
Capability inventory: The skill provides powerful capabilities including clicking, form filling, executing arbitrary JavaScript (eval), managing session state/cookies (state save/load), and accessing local files via the --allow-file-access flag.
Sanitization: The skill does not implement sanitization or validation of the content retrieved from external websites before it is analyzed by the agent.
[COMMAND_EXECUTION]: The skill extensively uses the agent-browser CLI tool via Bash to perform browser operations. This allows the agent to interact with web elements, manage sessions, and capture data programmatically.
[EXTERNAL_DOWNLOADS]: Documentation in SKILL.md and references/commands.md mentions the installation of appium and its drivers via NPM, a well-known service, to support iOS browser automation and simulation features.

agent-browser