The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to clone an untrusted third-party repository (https://github.com/zhexulong/openreverse.git) and execute npm install. This allows for arbitrary code execution from a source outside of the trusted vendor list.
[COMMAND_EXECUTION]: The scripts/setup.ps1 script performs high-privilege operations, including installing software via winget, globally installing NPM packages (npm install -g agent-browser), and modifying the system environment PATH variable.
[DATA_EXFILTRATION]: The skill contains explicit JavaScript templates and instructions for extracting sensitive user data, specifically session cookies and localStorage contents, from browser sessions.
[PROMPT_INJECTION]: The skill provides pre-defined payloads for Cross-Site Scripting (XSS) and SQL Injection (SQLi) testing. While presented as testing tools, these templates can be misused to target third-party systems or trigger unintended behavior in the agent.
[INDIRECT_PROMPT_INJECTION]: The skill lacks sanitization or boundary markers when processing data from external web pages. Ingesting untrusted HTML or UI trees from arbitrary URLs (e.g., via agent-browser snapshot) creates a vulnerability surface where an attacker-controlled website could influence the agent's behavior.
[EXTERNAL_DOWNLOADS]: The skill automates the download of binaries (Chromium browsers) via npx playwright install and system packages via winget, which introduces supply chain risks if repositories or registries are compromised.

browser-automation