The Agent Skills Directory

[COMMAND_EXECUTION]: The --executable-path flag allows the agent to specify a path to an arbitrary local binary to be executed instead of the default browser, which could be used to launch malicious executables.
[REMOTE_CODE_EXECUTION]: The --extension flag permits loading arbitrary browser extensions from local paths. Malicious extensions can execute code in the context of every website visited and intercept all browser traffic.
[DYNAMIC_EXECUTION]: The eval and wait --fn commands allow for the execution of arbitrary JavaScript code directly within the browser's context, bypassing normal interaction constraints.
[DATA_EXFILTRATION]: The cookies and storage local commands provide functionality to extract sensitive session data, including authentication tokens and private user data, which can then be saved to files or potentially sent to external endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it is designed to navigate to external URLs and ingest their content into the agent's context.
Ingestion points: Content extraction commands defined in SKILL.md such as open, snapshot, get text, get html, and console logs.
Boundary markers: The instructions in SKILL.md lack delimiters or specific directives to ignore instructions that might be embedded in the retrieved web content.
Capability inventory: The skill possesses extensive capabilities in SKILL.md including writing files (screenshot, pdf, state save), managing network routes, and executing arbitrary script code.
Sanitization: No sanitization, filtering, or validation of the data retrieved from external web pages is implemented.

agent-browser