The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes untrusted data from web pages through commands such as read, fetch, page-text, snapshot, and eval. An attacker could embed malicious instructions in a web page (e.g., email bodies, social media posts) to influence the agent's behavior.
Ingestion points: The agent receives raw page content via page-text, snapshot, and read/fetch tool outputs.
Boundary markers: The skill instructions include a "Trust boundary" section warning the agent to treat page content as data, but no technical delimiters (like XML tags) are enforced in the data returned to the agent.
Capability inventory: The skill has extensive capabilities, including file uploads (upload), network navigation (navigate), authenticated GET requests (fetch), and injection of vaulted credentials (fill-secret).
Sanitization: No technical sanitization of the untrusted web content is described prior to it being processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs patchright (a stealth-patched Playwright driver) to the plugin's data directory during the first initialization.
[COMMAND_EXECUTION]: The skill relies on executing a Node.js CLI tool (agent-id-browser/bin/cli.mjs) via the Bash tool to perform its operations.
[DYNAMIC_EXECUTION]: The skill includes an eval command that allows for the execution of arbitrary JavaScript code within the context of the browser session.

agent-id-browser