The Agent Skills Directory

[OBFUSCATION]: Automated scans detected hidden Unicode characters intended for steganographic prompt injection in the bundled library file profile/Default/Extensions/ddkjiahejlhfcafbddmgiahcphecmpfh/2026.201.1924_0/lib/codemirror/cm6.bundle.ubol.min.js. This technique can be used to silently influence agent behavior with instructions invisible to the user.
[PERSISTENCE]: The skill includes instructions and scripts (hooks/webfetch-preflight.sh, hooks/webfetch-fallback.sh) to modify the agent's global environment settings (~/.claude/settings.json and ~/.claude/CLAUDE.md). These modifications install persistent hooks that intercept standard tool calls.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a gateway for arbitrary, untrusted data to enter the agent's context.
Ingestion points: Web content is ingested via the stealth-browser read <url> command defined in SKILL.md.
Boundary markers: Output is passed back to the agent without any protective delimiters or "ignore embedded instructions" warnings.
Capability inventory: The skill possesses Bash, Read, and Write tool permissions, allowing for significant system impact if an injection occurs.
Sanitization: While the content is converted to Markdown, no security-focused sanitization or filtering of prompt-injection patterns is performed.
[METADATA_POISONING]: There is a discrepancy between the author context provided in the environment (changeflowhq) and the author listed in the skill's frontmatter (stevebutterworth). This deceptive metadata can lead to a misjudgment of the skill's provenance.
[EXTERNAL_DOWNLOADS]: The documentation (README.md) includes example commands that target a domain identified as malicious by automated scanners (https://another-site.com).

stealth-browser