The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains explicit instructions to extract sensitive session data from the browser.
Evidence: agent-browser --cdp 9222 eval 'localStorage.getItem("token") || document.cookie' in SKILL.md.
[DATA_EXFILTRATION]: The ability to programmatically extract authentication tokens and cookies provides a direct path for session hijacking if the agent is directed to send this data to an external endpoint.
[COMMAND_EXECUTION]: The skill executes shell commands to manage browser processes, including termination of existing instances.
Evidence: Instructions for kill -9 {PID} and taskkill /F /PID {PID}.
Evidence: Execution of setup scripts node {SKILL_DIR}/scripts/setup-cdp-chrome.js.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of an external global NPM package.
Evidence: npm install -g agent-browser documented as a prerequisite.
[DYNAMIC_EXECUTION]: The skill heavily relies on the eval command to execute arbitrary JavaScript within the browser context.
Evidence: Multiple examples of agent-browser --cdp 9222 eval with both plain text and Base64 encoded payloads.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface by ingesting untrusted web content and providing powerful tools to interact with it.
Ingestion points: agent-browser open "<URL>" (SKILL.md).
Boundary markers: None; the skill does not define delimiters or instructions to ignore embedded commands in the pages it visits.
Capability inventory: Arbitrary JS execution (eval), process termination (kill), and session data access (cookie/localStorage).
Sanitization: None; data retrieved from the browser (e.g., document.body.innerText) is passed directly to the agent without escaping.

browser-cdp