The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes browser_evaluate to execute JavaScript within the target's browser environment for vulnerability discovery (e.g., searching for sources and sinks) and browser_navigate to test exploitation vectors using URL fragments.
[EXTERNAL_DOWNLOADS]: References external security tools and repositories, specifically pointing to a browser extension at https://github.com/kevin-mizu/domloggerpp and mentioning the domdig scanner.
[DATA_EXFILTRATION]: Provides instructional examples of payloads designed to exfiltrate sensitive browser data, such as document.cookie and localStorage, to attacker-controlled external domains (e.g., https://ATTACKER/steal).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted content from external web pages using high-privilege browser automation tools.
Ingestion points: External target URLs and the JavaScript/HTML code residing on those pages, including postMessage data and URL parameters.
Boundary markers: None identified; the skill does not instruct the agent to distinguish between its own internal instructions and content discovered on target pages.
Capability inventory: Employs browser_open, browser_evaluate, browser_navigate, and browser_screenshot to interact with and extract data from target environments.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external sources before it is analyzed or used to drive browser actions.

xss-dom