The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation instructs users to install the CLI tool using curl -fsSL https://cli.inference.sh | sh, which is a pattern that downloads and executes an unverified script from a remote source. Additionally, the execute function allows running arbitrary JavaScript code within the browser context.
[COMMAND_EXECUTION]: The skill is configured with allowed-tools: Bash(infsh *), allowing the agent to execute shell commands via the infsh CLI utility.
[EXTERNAL_DOWNLOADS]: The installation process downloads compiled binaries from dist.inference.sh, which is not a verified trusted source.
[DATA_EXFILTRATION]: The upload action in the interact function allows the agent to send local files to the remote browser session.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted web content.
Ingestion points: Web page DOM, text content, and metadata are ingested via the open and snapshot functions as described in SKILL.md.
Boundary markers: No specific delimiters or instructions are provided to the agent to differentiate between untrusted browser content and its core instructions.
Capability inventory: The skill possesses high-privilege capabilities including shell command execution (infsh), arbitrary JavaScript execution (execute), and file uploads.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external websites before it is processed by the agent.

agent-browser