The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill supports the skills get command, which allows fetching and installing 'capability packs' from third-party sources, effectively acting as an unverified package manager.
[EXTERNAL_DOWNLOADS]: The upgrade command facilitates self-updating of the underlying automation binary from remote sources.
[COMMAND_EXECUTION]: The eval command allows for the execution of arbitrary JavaScript within the browser context, which can be misused if the agent is directed to execute untrusted scripts.
[DATA_EXFILTRATION]: The skill provides access to the host system's clipboard through clipboard read. Additionally, the network har functionality can capture full request and response bodies from network traffic, which frequently contains sensitive authentication tokens and cookies.
[PRIVILEGE_ESCALATION]: Included documentation and templates for sandbox environments (e.g., upstream-sandbox.md) suggest workflows that use sudo to install system-level dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from web pages via snapshots and text extraction. While it recommends the use of --content-boundaries to help the agent distinguish between tool output and page content, these markers are optional and do not fully mitigate the risk of a malicious website influencing the agent's behavior via the context window.

browser-tools