A shared agent-skill library means a flawed skill could travel as far as a good one

Shubhankar Srivastava of Browserbase argued that browser agents can learn how a website works, save it as a reusable skill, and share it widely. He made the case on the AI Engineer show. A shared library like that is useful. It also means one flawed skill could reach many agents at once.

What was said

Srivastava described a loop called AutoBrowse. One agent drives the browser. A second agent studies the screenshots and run records after each attempt and writes notes for the next try. His example was a flight search. The agent found it could put the whole search into the web address, which skips the calendar clicking.

The end product is a skill file. Browserbase turned this into Browse.sh. Having done it for one site, Srivastava said, the team asked why not go to 500 and give it away. His team pays the token costs, the AI usage fees. A speaker on the show put it this way: "This is yellow pages for browser agents, right?"

He added that a skill is essentially markdown, a plain text format. It works in any agent or developer toolkit, and it does not need Browserbase.

Why it matters

Srivastava also said some customers have built pipelines that create skills as needed and file pull requests on their own. If something breaks in production, an agent steps in to repair the skill. For anyone buying or running agents, the questions are practical. Where do skills come from? Who reviews them? What happens when one changes?

The other side

Srivastava did not wave the risk away. Asked how a website could trick the learning loop into absorbing something malicious, he named three layers: controls on the incoming query, a skill layer meant to resist being tricked, and network and action limits on the browser. He also said Browserbase tries to run generated skills past a security-review agent of some kind before publishing them on Browse.sh.

He raised the cases of a hacked amazon.com and of hidden instructions in an Amazon listing. "I know browser is a crazy threat vector when you think about it, like it has access to anything on the wild web," he said.

The talk gave no figures on how often the reviewer agent catches a bad skill. It also left unclear who is accountable once a skill reaches agents outside Browserbase's control. For consumer-facing use, he encouraged customers to add their own guardrails against prompt injection, where hidden text hijacks an agent.