The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/mcp-client.py implements subprocess.Popen with shell=True in the StdioTransport class, which could allow for execution of shell commands if the --stdio argument is controlled by untrusted data.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx @playwright/mcp@latest in scripts/start-server.sh and SKILL.md to fetch and run the Playwright MCP server from the official npm registry. Playwright is a well-known project from Microsoft.
[PROMPT_INJECTION]: The skill's ability to browse arbitrary URLs creates an attack surface for indirect prompt injection. Ingestion points: External website content accessed via browser_navigate and browser_snapshot. Boundary markers: None identified. Capability inventory: Powerful browser tools like browser_run_code and browser_click are available to the agent. Sanitization: Web content is not sanitized before being presented to the agent.
[REMOTE_CODE_EXECUTION]: The browser_run_code and browser_evaluate tools allow for the execution of arbitrary JavaScript within the browser context, which is a form of dynamic execution intrinsic to the skill's purpose.
[DATA_EXFILTRATION]: The browser_file_upload tool allows the agent to interact with local files using absolute paths. An attacker could use indirect prompt injection on a web page to command the agent to upload sensitive local files to an external server.

browser-use