The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external websites into the agent's context, creating an attack surface for indirect prompt injection. A malicious website could include hidden instructions designed to manipulate the agent's behavior or exfiltrate data from the current session.
Ingestion points: External web content is ingested via the 'open', 'snapshot', and 'interact' functions as documented in SKILL.md.
Boundary markers: No explicit delimiters or isolation warnings are used to wrap the element descriptions or page text returned to the agent.
Capability inventory: The skill possesses high-privilege capabilities including JavaScript execution ('execute'), file uploads ('upload'), and arbitrary page interaction ('interact').
Sanitization: Content from the web is processed as raw text or structured metadata without specific sanitization against prompt injection patterns.
[EXTERNAL_DOWNLOADS]: The skill references external installation instructions and a CLI tool ('belt') from the author's official GitHub repository (inference-sh) and domain (inference.sh). These references are necessary for the tool's intended operation and trace back to the vendor's infrastructure.
[DYNAMIC_EXECUTION]: The 'execute' function enables the execution of arbitrary JavaScript code within the context of the automated browser. While this is a standard feature for web automation, it provides a mechanism for dynamic code execution that could be abused if the agent is compromised by indirect injection.
[COMMAND_EXECUTION]: The skill relies on the 'belt' CLI tool for all operations. The execution environment is restricted through the 'allowed-tools' frontmatter to only permit the 'belt' command, which helps minimize the risk of arbitrary command injection.

agent-browser