The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and templates demonstrate the use of the belt and infsh CLI tools to interact with the browser automation service. These commands are used to manage browser sessions and perform automation tasks.
[DYNAMIC_EXECUTION]: The skill provides an execute function that allows the execution of arbitrary JavaScript code within the browser context. While this is a standard and necessary feature for advanced web automation, it represents a significant capability that could be misused if the agent is influenced by malicious external content.
[DATA_EXFILTRATION]: Documentation in references/authentication.md explicitly shows how to extract sensitive session data, such as cookies, using the execute function (e.g., document.cookie). This capability allows the agent to access and potentially exfiltrate session identifiers.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external, potentially untrusted web pages and possesses the capabilities required to act on injected instructions.
Ingestion points: Untrusted data enters the agent context via functions that extract page text, links, and DOM elements (e.g., snapshot, open, and execute using document.body.innerText).
Boundary markers: There are no explicit instructions or delimiters in the skill body that guide the agent to ignore or treat extracted web content as untrusted data.
Capability inventory: The skill includes the ability to execute JavaScript, fill forms, click elements, and upload files to the browser session.
Sanitization: The skill does not appear to perform any sanitization or filtering of the extracted web content before it is passed to the agent's context.

agent-browser