The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of an external package 'agent-browser' via npm install -g agent-browser and subsequently downloads Chromium through agent-browser install. These resources do not originate from a recognized trusted organization or well-known service.
[REMOTE_CODE_EXECUTION]: The agent-browser eval command allows the agent to execute arbitrary JavaScript strings within the browser session. This capability provides a direct vector for code execution in the browser context, which can be exploited to interact with sensitive session data or bypass client-side security.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform complex browser interactions (open, click, fill, screenshot). This gives the agent broad control over a browser process running on the host system.
[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection as it processes untrusted content from the web.
Ingestion points: Web content is ingested into the agent context via agent-browser snapshot, agent-browser get text, and agent-browser get html as described in SKILL.md and references/ai-snapshot-workflow.md.
Boundary markers: Absent. The instructions do not provide delimiters or warnings to treat the retrieved web content as untrusted data.
Capability inventory: The agent has access to Bash, can execute arbitrary JS via eval, set credentials, and manage cookies/storage.
Sanitization: Absent. There is no evidence of filtering or sanitizing the retrieved HTML or text before it is presented to the agent for decision-making.

agent-browser