The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides an execute function that allows the AI agent to run arbitrary JavaScript code within the context of navigated web pages. This capability enables complex interactions but also serves as an execution vector for code generated by the agent or influenced by external content.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because it is designed to ingest and process data from untrusted external web pages while maintaining powerful interaction capabilities.
Ingestion points: External data enters the agent context via the open, snapshot, and execute functions which retrieve URL content, DOM elements, and page text.
Boundary markers: The instructions do not implement boundary markers or explicit directives to ignore embedded commands within the retrieved web content.
Capability inventory: The agent can perform clicks, form submissions, arbitrary JavaScript execution, and has access to the belt CLI tool.
Sanitization: Content retrieved from the web is not sanitized or filtered before being presented to the agent for processing.
[DATA_EXFILTRATION]: The skill includes functionality and documentation for extracting sensitive session information. Specifically, it provides methods to retrieve browser cookies via document.cookie, full page text, and screenshots, which could be misused to harvest credentials or personal data from authenticated sessions.

agent-browser