The Agent Skills Directory

[COMMAND_EXECUTION]: The skill spawns detached background processes to monitor browser activity. start-capture.mjs initiates cdp-firehose.mjs and snapshot-loop.mjs as background tasks using spawn with the detached: true flag, allowing them to persist independently of the main process.
[COMMAND_EXECUTION]: Integration with the Browserbase platform involves executing the browse CLI tool within bb-capture.mjs and bb-finalize.mjs to manage remote browser sessions and retrieve artifacts.
[EXTERNAL_DOWNLOADS]: Documentation recommends installing the @browserbasehq/browse-cli package via npm to enable remote browser automation features, which is an official tool for a well-known browser automation service.
[PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection because it ingests untrusted data from external web pages, including DOM content, console logs, and network metadata.
Ingestion points: CDP protocol events captured by cdp-firehose.mjs and DOM/URL snapshots retrieved in snapshot-loop.mjs via Runtime.evaluate.
Boundary markers: The SKILL.md documentation contains explicit warnings instructing the agent to treat captured data as untrusted evidence rather than instructions to be executed.
Capability inventory: The skill has the capability to read and write to the local filesystem (under the .o11y directory) and interacts with browser targets using the Chrome DevTools Protocol.
Sanitization: No automated sanitization is performed on the captured content; the system relies on the agent's internal safety guardrails and the provided instructional warnings.
[DATA_EXFILTRATION]: The trace artifacts collected in the .o11y/ directory represent a significant data exposure risk. These files contain full network traffic, which may include sensitive session cookies, authorization headers, and other bearer tokens from the browser session. The skill includes documentation warning the user that these artifacts are sensitive materials.

browser-trace