The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from arbitrary URLs provided by users, which creates a surface for malicious instructions to be embedded in external data.
Ingestion points: Accesses page content through tools like view-screen, get-page-text, and tabs_context as specified in SKILL.md.
Boundary markers: Employs a soft boundary by instructing the agent to never infer extra work from page content, though no formal structural delimiters are enforced for all inputs.
Capability inventory: High capabilities including JavaScript evaluation (javascript_tool, Runtime.evaluate), browser control, and data mutation tools.
Sanitization: No explicit sanitization or filtering of read data is implemented before it enters the agent's context.
[DYNAMIC_EXECUTION]: Interaction with the web page relies on the dynamic construction and execution of JavaScript snippets.
Script generation: The skill uses host-level evaluators such as Claude Code's javascript_tool and Codex's Runtime.evaluate to execute logic against window.__agentNativeWebMcp and document.modelContext.
[COMMAND_EXECUTION]: Utilizes platform-specific commands to manage the browser lifecycle.
Tool usage: Invokes tools like preview_start, tabs_select, and cua.createBrowserTab to initialize sessions and navigate to URLs.
[REMOTE_CODE_EXECUTION]: Provides an installation command that executes code from a remote source.
Evidence: The README.md file contains an instruction to use npx @agent-native/skills@latest add --skill webmcp, which downloads and executes content from the npm registry.

webmcp