The Agent Skills Directory

[COMMAND_EXECUTION]: Shell script templates and documentation examples (found in templates/authenticated-session.sh and references/authentication.md) are vulnerable to shell command injection. Environment variables such as $APP_USERNAME and $PASSWORD are interpolated directly into shell strings (e.g., text": "'"$APP_USERNAME"'"). A malicious payload in these variables could lead to the execution of arbitrary commands on the user's system.\n- [DATA_EXFILTRATION]: The execute function allows for arbitrary JavaScript execution within the browser context. The documentation in references/authentication.md specifically demonstrates how to extract sensitive session data, such as cookies via document.cookie, which poses a risk of data exfiltration if the agent is misused or compromised.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from arbitrary external websites without proper isolation or sanitization.\n
Ingestion points: Browser DOM data and page text are ingested via the open and snapshot functions (SKILL.md, references/snapshot-refs.md).\n
Boundary markers: There are no delimiters or specific instructions to the agent to treat web content as untrusted data.\n
Capability inventory: The agent can perform high-impact actions like clicking, typing, file uploading, and executing JavaScript (interact, execute).\n
Sanitization: No sanitization, validation, or filtering is applied to the content retrieved from web pages.\n- [EXTERNAL_DOWNLOADS]: The skill documentation suggests installing the belt CLI tool via npx and references installation scripts and resources hosted on github.com/inference-sh and inference.sh.

agent-browser