The Agent Skills Directory

[DYNAMIC_EXECUTION]: The eval command enables the execution of arbitrary JavaScript in the browser context, which is a vector for dynamic code execution.
[CREDENTIALS_UNSAFE]: The skill mentions that session state files (auth.json) store tokens in plaintext by default. This behavior presents a risk of credential exposure if these files are not handled securely.
[DATA_EXFILTRATION]: The --allow-file-access flag allows the browser to read local files, which could be combined with navigation to external sites to exfiltrate local data.
[OBFUSCATION]: The eval command supports Base64-encoded JavaScript via the -b flag, providing a built-in method for obfuscating commands.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted web content, creating an attack surface for indirect injection. Evidence Chain: 1. Ingestion points: Browser snapshots, screenshots, and text extraction defined in SKILL.md. 2. Boundary markers: The skill provides an opt-in --content-boundaries feature. 3. Capability inventory: Navigation, interaction, arbitrary JS execution (eval), and local file access. 4. Sanitization: Opt-in markers are supported.
[COMMAND_EXECUTION]: The skill executes shell commands via the agent-browser CLI, as defined in the allowed-tools metadata.

agent-browser