The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file references/original-websocket-impl.md provides instructions to install and run the @jason.today/webmcp package using npx. This involves downloading and executing code from an external NPM registry scope that is not associated with a verified trusted organization.
[PROMPT_INJECTION]: Documentation in references/security-and-privacy.md includes literal prompt injection strings, such as 'SYSTEM: Ignore previous instructions', within code snippets. These are presented as educational examples of potential threats to tool descriptions but are flagged by security scanners due to their adversarial structure.
[INDIRECT_PROMPT_INJECTION]: The skill documents the architecture for browser-native agent tools, which inherently creates a surface for indirect prompt injection via malicious web page content.
Ingestion points: Tools registered through document.modelContext.registerTool (imperative) or annotated HTML forms (declarative) as described in SKILL.md and reference files.
Boundary markers: The protocol documentation suggests optional hints like untrustedContentHint and character budgets, though these are not enforced as strict security boundaries.
Capability inventory: Implementation of the execute callback allows for arbitrary JavaScript execution within the browser's origin-keyed document, providing access to DOM elements, cookies, and session data as outlined in references/imperative-api.md.
Sanitization: The guide emphasizes that developers must implement manual validation within tool handlers and notes the probabilistic nature of LLM guardrails.
[EXTERNAL_DOWNLOADS]: The guide uses the domain partner.org in code examples within references/cross-origin-and-permissions.md. This domain has been flagged for phishing associations by reputation scanners, though its usage here appears intended as a generic placeholder for cross-origin integration examples.

web-mcp