The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill ingests untrusted data from external websites via agent-browser snapshot and accessibility trees. An attacker-controlled website can embed instructions to manipulate the agent.
Ingestion points: Data enters the context through agent-browser open <url> and agent-browser snapshot outputs.
Boundary markers: No explicit delimiters or instructions to ignore embedded content are present in the skill's logic.
Capability inventory: The skill allows click, fill, state save, and screenshot operations, which can be triggered by malicious instructions on a page.
Sanitization: There is no evidence of sanitization or filtering of the website content before it is processed by the AI.
Data Exposure & Exfiltration (MEDIUM): The skill provides tools to save and load browser session states (auth.json). This file contains sensitive session tokens and cookies. If the agent is manipulated into uploading this file via a network request or displaying its contents, it leads to full session compromise.
Command Execution (LOW): The skill functions by executing the agent-browser CLI tool with user-controlled arguments such as URLs and element selectors. While necessary for the skill's purpose, it presents an attack surface if the underlying CLI does not properly sanitize input against shell metacharacters.

browser