The Agent Skills Directory

Indirect Prompt Injection: Because the skill is designed to navigate, snapshot, and extract text from external websites, it is susceptible to indirect prompt injection. Maliciously crafted content on a webpage could attempt to provide instructions to the agent.
Ingestion points: Commands such as open, snapshot, and get text bring data from external, untrusted URLs into the agent's context in the files SKILL.md and templates/capture-workflow.sh.
Boundary markers: The documentation describes how the data is returned but does not implement explicit delimiters to separate web content from agent instructions.
Capability inventory: The agent has significant capabilities including browser interaction, JavaScript execution, and filesystem access (via screenshots and uploads).
Sanitization: The skill does not explicitly mention sanitization of extracted web content before it is processed by the agent.
Dynamic JavaScript Execution: The eval command allows the agent to execute arbitrary JavaScript within the browser context. This is a standard feature for advanced automation but warrants careful use, as it could be leveraged to interact with sensitive session data or perform unauthorized actions on a webpage.
Local Filesystem Access: The tool supports the file:// protocol for navigation and provides an upload command. These features allow the browser tool to interact with the local filesystem, which is necessary for testing local resources but could lead to unintended exposure of local files if used without proper oversight.
Session State Management: The state save and state load commands manage browser session data, including cookies and authentication tokens, by storing them in local JSON files. The documentation in references/authentication.md correctly highlights that these files are sensitive and provides guidance on how to handle them securely.

agent-browser