The Agent Skills Directory

EXTERNAL_DOWNLOADS (HIGH): The installation instructions require npm install -g agent-browser and agent-browser install. This fetches a package and a Chromium binary from untrusted/unverifiable sources (author 'bentossell'), posing a supply chain risk.
**PROMPT_INJECTION
Category 8 (HIGH):** This skill is a primary vector for Indirect Prompt Injection.
Ingestion points: Data enters the agent context via agent-browser snapshot, get text, and get html from any URL opened.
Boundary markers: None identified; untrusted web content is processed as raw text/HTML.
Capability inventory: The skill has access to the bash and computer tools, and includes an eval command for arbitrary JavaScript execution.
Sanitization: No sanitization or filtering of web content is documented.
Risk: An attacker-controlled website could contain malicious instructions that the agent reads and subsequently executes via the bash tool or eval command.
REMOTE_CODE_EXECUTION (HIGH): The agent-browser eval command allows the execution of arbitrary JavaScript within the browser context. If the input for this command is derived from untrusted web content (e.g., via a snapshot), it can lead to cross-site scripting (XSS) or further exploitation if the agent leaks local data.
COMMAND_EXECUTION (HIGH): The skill requires the bash and computer tools. These allow for full system control. When combined with the browser's ability to read external data, this creates a high-risk execution environment.
CREDENTIALS_UNSAFE (MEDIUM): The commands state save auth.json and state load auth.json handle sensitive session cookies and authentication tokens. If used in shared or poorly secured environments, these files could be targeted for credential theft.

agent-browser