The Agent Skills Directory

REMOTE_CODE_EXECUTION (CRITICAL): Located in scripts/browser_server.py. The server listens on a world-writable Unix socket (/tmp/browser_server.sock) and passes input directly to eval() and exec() functions within the execute_command method. This allows any process or local user to execute arbitrary Python code with the privileges of the server process.
PROMPT_INJECTION (HIGH): The skill is vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: Untrusted web content is brought into the agent's context via the snapshot() method in scripts/browser_client.py.
Boundary markers: No delimiters or instructions are present to prevent the agent from obeying instructions embedded in the captured web data.
Capability inventory: The skill provides extensive write and interaction capabilities, including click, type_text, fill_form, and press_key, allowing an attacker to perform actions on behalf of the user.
Sanitization: No content sanitization or validation is performed on the data retrieved from the browser.
CREDENTIALS_UNSAFE (HIGH): The scripts/sign_up.py script accepts passwords as plain-text command-line arguments, exposing sensitive credentials to system logs, process lists, and shell history.
COMMAND_EXECUTION (CRITICAL): The scripts/run_browser_ops.py utility provides a CLI interface for executing arbitrary Python strings through eval() and exec(), which can be abused to run malicious commands on the host system.

reddit-browser-automation