The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a comprehensive CLI for browser control, enabling the agent to perform navigation, element interaction, and data extraction within a Bash environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process content from external, untrusted websites, presenting a vulnerability to indirect prompt injection.
Ingestion points: External web data is brought into the agent context via commands like snapshot and get text (documented in SKILL.md and references/snapshot-refs.md).
Boundary markers: There are no instructions for the agent to use delimiters or ignore instructions embedded in the web content it retrieves.
Capability inventory: The skill possesses capabilities for network operations, file creation (screenshots/PDFs), and JavaScript execution, which could be misdirected by injected instructions.
Sanitization: No mechanisms for sanitizing or validating the content of retrieved web pages are described.
[DYNAMIC_EXECUTION]: The agent-browser eval command permits the execution of arbitrary JavaScript in the browser. The documentation (e.g., in SKILL.md) suggests using Base64 encoding or standard input to deliver scripts, which facilitates the execution of complex logic.
[DATA_EXFILTRATION]: The tool supports local file access through the file:// protocol when the --allow-file-access flag is used. This capability, combined with the browser's ability to transmit data to remote servers, creates a potential path for sensitive local data exfiltration.
[CREDENTIALS_UNSAFE]: The skill includes commands to save browser session states, including cookies and localStorage, to local JSON files (agent-browser state save). These files store sensitive authentication information that could be exposed if the local environment is compromised.

agent-browser