The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly supports the file:// protocol in the agent-browser open command. This enables an agent to access sensitive local files such as file:///etc/passwd, SSH keys, or configuration files, which can then be extracted using snapshot or get text commands.
[COMMAND_EXECUTION]: The agent-browser eval command allows for the execution of arbitrary JavaScript within the browser context. If the input to this command is derived from untrusted web content or user input, it creates a significant dynamic execution vector.
[COMMAND_EXECUTION]: The --executable-path global option allows the skill to launch arbitrary binaries from the local filesystem instead of a standard browser, which could be exploited to execute malicious code with the agent's privileges.
[CREDENTIALS_UNSAFE]: Multiple commands such as agent-browser set credentials <user> <pass>, set headers, and cookies set encourage the passing of sensitive secrets as plaintext arguments. These secrets may be exposed in shell command histories, process monitors, or logging systems.
[PROMPT_INJECTION]: As a browser automation tool, the skill is highly susceptible to Indirect Prompt Injection. It processes untrusted data from external websites via snapshots and text extraction; an attacker could embed malicious instructions in a webpage to hijack the agent's logic once the page is 'read'.
[DATA_EXFILTRATION]: The agent-browser state save command persists session cookies and authentication tokens to local files (e.g., auth-state.json). While the documentation warns against committing these files, their presence on disk represents a risk of credential exposure if the environment is compromised.

agent-browser