The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection in Step 1. It takes a user-supplied URL and interpolates it directly into a bash command: curl -s -o /dev/null -w \"%{http_code}\" <url>. An attacker can provide a URL containing shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands on the host.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by delegating browser control to a subagent using user-provided instructions.\n
Ingestion points: The numbered steps from the user flow and the URL are interpolated into the subagent's system prompt.\n
Boundary markers: There are no delimiters or boundary markers used in the subagent template to separate the user-provided data from the system instructions.\n
Capability inventory: The subagent has broad capabilities including browser navigation, interaction (click, fill), network request monitoring, console log access, and local file writes for screenshot storage.\n
Sanitization: The skill does not mention any validation, filtering, or escaping of the user-provided test steps before they are processed by the subagent.\n- [DATA_EXFILTRATION]: The skill performs extensive monitoring of the browser session, including capturing screenshots, network request logs, and console messages. This data is saved to a local .qa/ directory. While intended for debugging, this creates a data exposure risk if the targeted site contains sensitive information (credentials in console logs, PII in screenshots, or tokens in API requests) which is then accessible to the agent or other processes.

browser-qa