The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the web using an LLM (Claude Haiku 4.5) to drive browser interactions, which creates a significant surface for indirect prompt injection attacks where a website could steer the agent's actions.
Ingestion points: Untrusted web content retrieved through browser navigate, browser extract, and browser observe (SKILL.md, REFERENCE.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are mentioned in the tool's interaction logic.
Capability inventory: The skill utilizes the Bash tool and can perform arbitrary browser actions, including clicks, form submissions, and data extraction.
Sanitization: No sanitization or filtering of the retrieved web content is documented before it is analyzed by the AI model.
[DATA_EXFILTRATION]: The skill uses a persistent browser profile located in .chrome-profile/ which stores session cookies and history, potentially exposing sensitive data. Furthermore, the browser has full network access and can interact with localhost and internal network resources, which could be exploited for data harvesting from the local environment.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute its core automation functionality via a custom CLI command and handles complex browser interactions based on natural language input.

stagehand-browser-cli