The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the web.
Ingestion points: Untrusted data enters the agent's context through web page navigation and snapshots via commands like agent-browser open and agent-browser snapshot in SKILL.md.
Boundary markers: The documentation recommends using the --content-boundaries flag to wrap page output in nonces, but this is an optional, opt-in feature.
Capability inventory: The skill provides high-impact tools including click, fill, eval (JavaScript execution), and allow-file-access (local file reading) which could be manipulated by malicious content on a processed web page.
Sanitization: Beyond the recommended boundary markers, no specific sanitization or filtering of web-sourced content is described.
[COMMAND_EXECUTION]: The skill uses the agent-browser CLI tool for all operations, which allows for the execution of arbitrary JavaScript within the browser context via the eval command. This is a core feature of the tool but adds to the potential attack surface.
[DATA_EXFILTRATION]: The tool includes an --allow-file-access flag that enables the browser to read local files. This capability, combined with the browser's ability to navigate to external URLs and perform interactions like form submissions, creates a potential vector for exfiltrating sensitive local data if an agent is influenced by a malicious website.
[EXTERNAL_DOWNLOADS]: The documentation mentions installing the appium package and its drivers via npm to support iOS mobile browser automation. These are standard dependencies for the tool's mobile-specific functionality and are used as intended for the primary skill purpose.

agent-browser