The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The browser-cookies.js script extracts and prints all browser cookies from the active session to the console, which can include sensitive session tokens and authentication data used for debugging session state.\n- [DATA_EXFILTRATION]: The browser-start.js utility accesses sensitive browser profile directories such as ~/.config/google-chrome/ or ~/Library/Application Support/Google/Chrome/ to duplicate user session data (cookies, logins, and history) for the agent's browser instance.\n- [COMMAND_EXECUTION]: browser-start.js utilizes execSync and spawn to run system commands like mkdir, rm, and rsync for managing browser profile directories and launching the browser with remote debugging enabled.\n- [PROMPT_INJECTION]: The browser-content.js script fetches and processes untrusted external website content into markdown, creating a surface for indirect prompt injection attacks.\n
Ingestion points: browser-content.js (scrapes the full outerHTML of any URL provided as an argument).\n
Boundary markers: None present in the scripts to delimit external content or warn the agent to ignore instructions embedded within the processed text.\n
Capability inventory: The skill provides high-risk capabilities including browser-eval.js (arbitrary JavaScript execution) and browser-cookies.js (credential access).\n
Sanitization: While the script uses Mozilla's Readability and Turndown to filter HTML, it does not sanitize the resulting text for adversarial instructions targeting the agent.

browser-tools