The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external websites, which represents an attack surface for indirect prompt injection.\n
Ingestion points: Data extraction functions in references/data_extraction_recipes.md and browser navigation workflows in SKILL.md consume raw content from arbitrary URLs.\n
Boundary markers: The skill lacks explicit instructions or delimiters to isolate extracted web content from agent instructions, increasing the risk of the agent following malicious commands embedded in scraped data.\n
Capability inventory: The skill possesses extensive capabilities including network navigation, form interaction, file writing (screenshots/PDFs/reports), and JavaScript execution within the browser context (page.evaluate).\n
Sanitization: While clean_text in references/data_extraction_recipes.md normalizes whitespace, no security-specific sanitization is implemented to filter potentially malicious instructions from extracted text.\n- [DYNAMIC_EXECUTION]: The toolkit includes scripts (scripts/scraping_toolkit.py and scripts/form_automation_builder.py) that dynamically generate Python automation scripts based on user-provided configuration and site structures. This results in the creation of new executable code at runtime.\n- [PRIVILEGE_ESCALATION]: The script generation tools utilize os.chmod to grant execute permissions (0o755) to the files they create. Modifying file permissions on dynamically generated content is a common pattern for CLI utilities but carries inherent security risks if the generation process is compromised.\n- [COMMAND_EXECUTION]: The skill facilitates the creation and execution of browser automation scripts that perform complex network operations and interact with web-based interfaces, which can be misused if targeting sensitive internal or authenticated services.

browser-automation