test safe agent-browser

受限的瀏覽器自動化工具。僅用於導航網頁、截圖、提取公開資料與測試。嚴禁在未啟用安全邊界的情況下執行。

This skill appears to implement a fairly powerful browser-automation workflow (snapshots, form automation, state save/load, JS eval, proxy routing, recording). That is coherent with its stated purpose, but be aware of these issues before you install or run it: - Missing manifest declarations: The skill's docs reference sensitive environment variables (APP_USERNAME, APP_PASSWORD, AGENT_BROWSER_ENCRYPTION_KEY, AGENT_BROWSER_ALLOWED_DOMAINS, proxy envs) but the registry metadata lists none. Ask the publisher to declare required env vars and explain why each is needed. - Secrets & state files: Templates save 'auth-state.json' files that contain session tokens/cookies. Treat these like secrets: store them only in a secure location, never commit them to source control, and delete them when no longer needed. - Arbitrary JS eval: The command agent-browser eval (with base64 or stdin) lets the agent execute arbitrary JavaScript in page context — useful for scraping but also a vector for data exfiltration or executing untrusted code. Only run in an isolated, network-restricted environment and restrict which pages the skill can visit (use AGENT_BROWSER_ALLOWED_DOMAINS). - Proxy and network routing: The skill supports configuring proxies and network routing. Malicious or misconfigured proxies can capture sensitive data or route traffic externally. Only use trusted proxies and validate proxy credentials are not leaked to the model or logs. - Prompt/injection hygiene: The SKILL.md itself recommends setting AGENT_BROWSER_CONTENT_BOUNDARIES to mitigate prompt injection. Ensure those runtime guards are actually enforced in your agent environment, and avoid giving the agent unfettered access to pages with user-controllable content unless you have strong sandboxing. - Practical steps: (1) Review the templates and run them first in a fully isolated sandbox (no sensitive network access). (2) Set and confirm AGENT_BROWSER_ALLOWED_DOMAINS before running automation against sensitive sites. (3) Do not expose APP_PASSWORD-style env vars to the model; prefer an external auth vault or ephemeral tokens. (4) If you cannot inspect or control the agent-browser binary that will be invoked, avoid using this skill. Given missing manifest declarations and the presence of actions that handle secrets and arbitrary execution, treat this skill as 'suspicious' until the publisher clarifies required env vars, confirms safety boundaries are enforced in your runtime, and you verify the external agent-browser binary and runtime policies.