The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate and extract data from arbitrary external URLs, creating a surface for indirect prompt injection where malicious websites could attempt to override agent instructions.
Ingestion points: The open and snapshot functions (found in SKILL.md and references/commands.md) ingest data from external websites into the agent's context.
Boundary markers: The skill does not provide explicit delimiters or instructions for the agent to ignore instructions embedded in the target website's content.
Capability inventory: The skill possesses extensive capabilities, including element interaction (click, fill, upload), arbitrary JavaScript execution (execute), and session recording (record_video).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external websites before it is presented to the agent.
[DYNAMIC_EXECUTION]: The skill provides an execute function (documented in references/commands.md) that allows the agent to run arbitrary JavaScript code within the browser session. While this is a core feature for web automation, it represents a high-capability tool that could be misused if the agent is misled by malicious content.
[DATA_EXFILTRATION]: The documentation in references/authentication.md describes how to use the execute function to extract browser cookies (document.cookie), which could be used to exfiltrate session data if the agent is directed to do so by an attacker.
[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md and templates recommend installing the belt CLI and related skills using npx skills add, which involves downloading and executing third-party packages.
[COMMAND_EXECUTION]: The authentication patterns in references/authentication.md include shell command execution for generating TOTP codes via the oathtool utility.

agent-browser