The Agent Skills Directory

[DATA_EXFILTRATION]: The agent-browser open command explicitly supports the file:// protocol, allowing the agent to navigate to and read local system files (e.g., .ssh/config, .env). When combined with extraction commands like snapshot or get text, this presents a risk of sensitive data exposure.
[DATA_EXFILTRATION]: The skill provides commands such as cookies and storage local which can be used to extract sensitive session tokens and authentication data from the browser environment.
[REMOTE_CODE_EXECUTION]: The agent-browser eval command allows for the execution of arbitrary JavaScript within the browser context, which could be misused to perform actions outside the scope of the intended automation.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection as it is designed to ingest and process untrusted data from external websites.
Ingestion points: Browser snapshot, get text, get html, and console commands (multiple files).
Boundary markers: None identified in the provided templates to isolate external content from agent instructions.
Capability inventory: The agent can perform file system writes (screenshot, pdf), network requests, and JavaScript execution.
Sanitization: No evidence of content sanitization or escaping before the retrieved data is processed by the agent.
[COMMAND_EXECUTION]: The Bash(agent-browser:*) tool configuration allows the agent to perform a wide range of system interactions, including writing artifacts like screenshots, PDFs, and session state files to the local filesystem.

agent-browser