The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill functions as a persistent JavaScript REPL, executing arbitrary code provided by the agent within the Safari browser environment using osascript. This capability allows for complex browser interactions but carries the risk of executing untrusted instructions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites (via DOM snapshots and text extraction), creating a significant surface for indirect prompt injection where malicious web content could influence agent actions.
Ingestion points: Untrusted data enters the context through tab.playwright.domSnapshot() in references/captcha.md, googleDocs.getLiveText() in references/google-docs.md, and googleSheets.readSheet() in references/google-sheets.md.
Boundary markers: No programmatic delimiters or explicit 'ignore instructions' warnings are enforced in the script logic; the skill relies solely on instructional warnings in the markdown documentation.
Capability inventory: The skill has the ability to execute shell commands (osascript), write images to the local filesystem, and perform native macOS UI automation (native clicks and keystrokes).
Sanitization: The skill lacks automated sanitization, validation, or filtering of the content extracted from web pages before it is processed by the agent.
[COMMAND_EXECUTION]: The scripts/safari-repl.mjs script executes sub-processes including /usr/bin/osascript and spawns itself as a detached background service to maintain the REPL session.
[DATA_EXFILTRATION]: The skill is designed to access and report private data from Google services (including account names and email addresses) and writes captured visual data (images) from the browser to local temporary storage.

control-safari