The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by reading external content from Bear Blog that may contain malicious instructions.\n
Ingestion points: The examples/browser-api-reference.md file contains instructions to read existing post headers and bodies from the Bear Blog dashboard using DOM selectors.\n
Boundary markers: There are no instructions or delimiters provided to the agent to treat the read content as untrusted or to ignore embedded instructions.\n
Capability inventory: The skill has extensive capabilities, including creating, editing, and deleting posts, as well as executing arbitrary JavaScript via the browser tool.\n
Sanitization: No sanitization or validation of the retrieved blog content is performed before it is presented to the agent.\n- [REMOTE_CODE_EXECUTION]: The skill employs dynamic JavaScript execution within the browser context to perform advanced automation tasks.\n
Evidence: The examples/browser-api-reference.md file provides templates for using the evaluate action to bypass browser confirmation dialogs (e.g., window.confirm = () => true) and to extract complex data structures from the webpage.\n- [COMMAND_EXECUTION]: The skill uses a set of browser-based commands to interact with the Bear Blog platform.\n
Evidence: Multiple files (SKILL.md, examples/post-workflow.md) instruct the agent to use navigate, fill, type, click, and snapshot actions to perform blog operations.

bearblog