The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's navigate, form, and interact commands include an --eval flag that enables the execution of arbitrary JavaScript within the browser session. This allows for complex, runtime-generated logic to be executed in the context of the websites being visited.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to scrape and interact with arbitrary external websites, creating a large surface for indirect prompt injection attacks.
Ingestion points: The extract and interact commands ingest raw text, HTML, and metadata from any URL the agent navigates to.
Boundary markers: The skill documentation does not provide instructions for the agent to use delimiters or ignore instructions found within the scraped content.
Capability inventory: The agent possesses high-impact capabilities, including the ability to write files (PDFs/screenshots), submit forms, and execute JavaScript in the browser context.
Sanitization: There is no evidence of sanitization or filtering of the external data before it is returned to the agent's context.
[DATA_EXPOSURE]: The skill facilitates the use of persistent Chrome profiles via the --user-data flag. This grants the agent access to sensitive user data, including cookies, active login sessions, and site preferences. While this enables automation of authenticated sites, it creates a risk where an agent could be manipulated into reading or exfiltrating session tokens via the --eval or extract commands.

browser-automation