The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @browserbasehq/stagehand package and the browse CLI. These are vendor-owned tools or standard development utilities necessary for the skill's primary functionality.
[COMMAND_EXECUTION]: The skill executes multiple local Node.js scripts (scaffold.mjs, compile.mjs, validate.mjs) to manage the tool lifecycle, including directory creation and test orchestration.
[REMOTE_CODE_EXECUTION]: The skill generates a TypeScript test script (stagehand-example.ts) based on the created tool manifest and executes it locally using tsx. This is an intended part of the development and validation workflow.
[PROMPT_INJECTION]: The skill processes content from external websites to generate tool manifests. This represents a potential surface for indirect prompt injection (Category 8). However, the risk is mitigated by explicit authoring rules and static security checks in the compilation script that prevent the use of eval or new Function in generated code.

webmcp-gen