The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from live websites, making it vulnerable to indirect prompt injection attacks.
Ingestion points: Browser interaction commands such as execute, ask, and extract read content from external URLs as seen in SKILL.md and references/browser_cli.md.
Boundary markers: The instructions do not provide explicit delimiters or warnings to the agent to treat page content as untrusted compared to its primary instructions.
Capability inventory: The agent can navigate, click, type, extract data, execute JavaScript via evaluate, and manage AWS resources as detailed in references/browser_cli.md and references/deployment_cli.md.
Sanitization: No sanitization or filtering of external web content is described.
[COMMAND_EXECUTION]: The skill uses a CLI tool (act) that performs system-level operations, including browser session management and AWS resource deployment in references/deployment_cli.md.
[DYNAMIC_EXECUTION]: The evaluate command allows for the execution of arbitrary JavaScript within the browser context to read DOM properties or control the page, as described in references/browser_cli.md.
[CREDENTIALS_UNSAFE]: The skill interacts with sensitive local files and credentials to facilitate authentication and session persistence.
Sensitive paths: The documentation refers to accessing ~/.aws/credentials, ~/.aws/config, and .env files for AWS and API key management in references/authentication.md.
Browser profiles: The rsync_from_default_user_data utility and --profile flags access sensitive local browser profile data, including history and cookies, in references/authentication.md.
[PRIVILEGE_ESCALATION]: The deployment functionality (act workflow deploy) automates the creation of high-privilege AWS resources, including IAM roles with wide permissions like nova-act:*, as documented in references/deployment_cli.md and references/workflow_definitions.md.

nova-act