The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Tools such as browser_get_text, browser_get_html, and browser_extract_data fetch content from arbitrary URLs into the agent's context.
Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore instructions embedded in the retrieved web content.
Capability inventory: The agent has capabilities to click, input text, execute scripts (run_script), and run shell commands for installation (pip, playwright).
Sanitization: There is no evidence of sanitization or filtering of the extracted web content before it is processed.
[DYNAMIC_EXECUTION]: The skill utilizes a custom scripting engine to replay recorded browser trajectories.
Evidence: The run_script tool executes a sequence of actions (steps) stored in a SQLite database. These steps are generated from previously recorded browser sessions via trajectory_to_script.
Risk: If the stored script data or the recording process is compromised, it could lead to the execution of unintended browser actions.
[COMMAND_EXECUTION]: The documentation instructs users to execute shell commands to set up the environment.
Evidence: Instructions include running pip install zerotoken, playwright install chromium, and mcporter install zerotoken.
Context: These are standard installation procedures for the tool's dependencies and are presented as transparent instructions to the user.
[EXTERNAL_DOWNLOADS]: The skill references and downloads dependencies from external sources.
Evidence: Fetches the zerotoken package from a registry and browser binaries via Playwright.
Context: These downloads target the vendor's own package and well-known services (Playwright/Microsoft), which are standard for this application.

zerotoken-openclaw