The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes high-risk command-line arguments such as --executable-path and --extension, which allow the agent to execute arbitrary local binaries or load potentially malicious browser extensions.\n- [REMOTE_CODE_EXECUTION]: The eval and wait --fn commands provide a mechanism for executing arbitrary JavaScript code within the browser context, which can be used to bypass security controls or manipulate page behavior.\n- [DATA_EXFILTRATION]: The open command explicitly supports the file:// protocol, creating a risk for local file exposure where sensitive system files could be read into the browser and subsequently extracted.\n- [DATA_EXFILTRATION]: Commands like cookies, storage, and state save allow for the extraction and persistence of sensitive session data, including authentication tokens and cookies.\n- [PROMPT_INJECTION]: The skill is inherently vulnerable to Indirect Prompt Injection because its primary purpose is to ingest and process data from untrusted external websites.\n
Ingestion points: agent-browser open <url>, agent-browser snapshot, and various get commands (e.g., get text, get html).\n
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the skill definition or instructions.\n
Capability inventory: Access to the file system (via screenshot, pdf, and state save), network access, and browser-side code execution (eval).\n
Sanitization: No evidence of content sanitization or validation of the data retrieved from the web.

agent-browser