The Agent Skills Directory

[COMMAND_EXECUTION]: The skill programmatically identifies and launches local browser executables (Chrome, Edge, or Chromium) using system-level commands to render webpages and extract their content.
Evidence: Found in scripts/cdp.ts within the findChromeExecutable and launchChrome functions, which use node:child_process.spawn to start the browser.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and parses arbitrary content from the public internet. A malicious website could include instructions intended to hijack the agent's logic when the resulting Markdown is reviewed.
Ingestion points: Untrusted data enters the agent context via the user-provided URL in scripts/main.ts, which is rendered and extracted into HTML.
Boundary markers: None; the Markdown output is generated and saved without explicit isolation delimiters or warnings to the agent that the content is untrusted.
Capability inventory: The skill has the ability to write to the local filesystem (node:fs/promises.writeFile) and execute local processes (node:child_process.spawn).
Sanitization: Content is processed through @mozilla/readability and turndown for structural cleanup, but these libraries do not filter for semantic prompt injection attacks.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive system directories to manage a dedicated browser profile, potentially exposing the agent to broader filesystem data.
Evidence: scripts/paths.ts contains logic to resolve the user's application data root (e.g., AppData on Windows or Library/Application Support on macOS) to store Chrome profile data.

baoyu-url-to-markdown