The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user-generated content from platforms like Instagram, LinkedIn, and X, which could contain malicious instructions.
Ingestion points: Commands such as state, get html, and get text in SKILL.md retrieve text from posts, DMs, and profiles.
Boundary markers: The skill contains a specific "Prompt Injection Defense" section instructing the agent to never execute instructions found in social media content.
Capability inventory: The agent can navigate the web, click/type (Bash tools), export cookies, and execute JavaScript via eval.
Sanitization: The skill enforces a domain allowlist for navigation and requires user confirmation for destructive actions.
[DATA_EXFILTRATION]: The skill has the capability to access, export, and manage browser cookies to maintain authenticated sessions.
Evidence: The cookies export and cookies get commands in SKILL.md facilitate the extraction of session data to local files (~/.browseruse/cookies/).
[DYNAMIC_EXECUTION]: The skill provides a command for executing arbitrary JavaScript within the browser context.
Evidence: The browser-use eval command in SKILL.md allows running JS code for DOM queries and data extraction, which could be bypassed to perform unauthorized actions if not strictly monitored.
[COMMAND_EXECUTION]: The skill relies on a suite of Bash-based tools to interact with the underlying browser-use CLI.
Evidence: The allowed-tools section in the frontmatter lists numerous Bash commands that wrap the browser automation engine.
[EXTERNAL_DOWNLOADS]: The skill references external resources for documentation and repository management.
Evidence: The skill links to https://github.com/browser-use/browser-use for the project homepage and documentation.

browser-use