The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains multiple instructions to download and execute code from an unverified remote source. Specifically, admin.py and the documentation in interaction-skills/profile-sync.md recommend running curl -fsSL https://browser-use.com/profile.sh | sh. This pattern is a critical risk as it allows for arbitrary shell command execution from a third-party domain that is not recognized as a trusted vendor.
[CREDENTIALS_UNSAFE]: The sync_local_profile function in admin.py facilitates the extraction of sensitive authentication cookies from a user's local browser profiles. These session tokens are then uploaded to a remote API at api.browser-use.com. This capability directly exposes the user's active login sessions to an external infrastructure.
[DATA_EXFILTRATION]: The tool's architecture supports sending browser state and profile data to a cloud service (browser-use.com). It provides a direct mechanism for the transmission of sensitive information, including full authentication state, from the user's local machine to a non-standard third-party endpoint.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that explicitly tell the agent to bypass user confirmation for system-level actions. It states that if an update is available, the agent should run browser-harness --update -y and 'don't ask the user first'. This instruction encourages the agent to make high-privilege changes and execute remote updates autonomously, increasing the risk of unauthorized code execution.
[REMOTE_CODE_EXECUTION]: The entry point run.py uses the exec() function to execute Python code received via standard input. This enables the execution of arbitrary code on the host system, which could be abused if the agent's logic is manipulated by external inputs.
[COMMAND_EXECUTION]: The admin.py and daemon.py scripts utilize subprocess.run and subprocess.Popen to manage external tools and the daemon process. This includes running the profile-use tool which is recommended to be downloaded via a piped shell script from an untrusted source.
[PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it is designed to scrape and interact with untrusted third-party websites. It ingests external data directly into the agent's context and executes JavaScript in the browser without robust sanitization, which could allow malicious website content to manipulate the agent into executing dangerous commands through the harness's privileged capabilities.

browser-harness