The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the browse CLI tool to perform browser interactions, which are executed through Bash commands (SKILL.md).
[EXTERNAL_DOWNLOADS]: The skill metadata and instructions recommend the installation of the browse npm package (SKILL.md).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the web.
Ingestion points: Data is brought into the agent's context through browse snapshot, browse get text, and browse get html (SKILL.md, REFERENCE.md).
Boundary markers: The instructions do not define delimiters or provide specific warnings to the agent to ignore instructions contained within the fetched content.
Capability inventory: The skill has the ability to execute Bash commands, interact with web pages (click, type, fill), and write network logs or screenshots to the local filesystem (REFERENCE.md).
Sanitization: There is no mechanism described for sanitizing or filtering external content before it is processed by the agent.
[REMOTE_CODE_EXECUTION]: The browse eval command allows for the execution of arbitrary JavaScript code within the context of the browser page (REFERENCE.md).

browser