Agent Browser

This skill appears to implement a real browser-automation CLI, but there are several things to check before installing or running it: - Provenance: There is no homepage and the registry metadata gives an unknown source. Inspect the npm package 'agent-browser' (version author, README, and published files) before running npm install -g. Prefer a package with a verifiable repository and maintainer. - Runtime requirements mismatch: SKILL.md requires Node.js/npm but the registry metadata lists no required binaries—make sure your environment meets the tool's needs and be cautious when running setup scripts. - Data exposure: The tool can access file:// URLs, download/upload files, eval JS in page contexts, and save auth/state to disk. Do not provide sensitive credentials (passwords, API keys, private tokens) to the agent unless you trust the package and have verified where/how those secrets are stored. Consider using dedicated test accounts. - Install safely: Run the setup in an isolated environment (container, VM) so the npm package and its install scripts cannot access your primary host. After installation, inspect installed files under the global npm directory. - Hardening: If you proceed, set AGENT_BROWSER_ALLOWED_DOMAINS to a strict allowlist, enable AGENT_BROWSER_CONTENT_BOUNDARIES, and limit AGENT_BROWSER_MAX_OUTPUT. Review and control any saved state/auth files (their formats and locations). - If you are unsure: Ask the publisher for a repository link and package provenance, or prefer a well-known, audited browser-automation tool (e.g., Playwright/Puppeteer) with clear origin and reproducible install steps.