The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests and processes untrusted data from live web pages, creating a vulnerability to malicious instructions embedded in external sites.
Ingestion points: The snapshot tool captures raw HTML, ARIA trees, and browser state (including cookies and localStorage) from arbitrary URLs accessed during exploration (SKILL.md).
Boundary markers: The instructions lack specific delimiters or "ignore previous instructions" warnings to help the agent distinguish between the web page's content and the skill's operational instructions.
Capability inventory: The agent has access to run_code (arbitrary CodeceptJS/JavaScript execution) and snapshot (sensitive data retrieval), which could be abused if the agent is tricked by page content.
Sanitization: No sanitization or validation logic is provided for handling the retrieved HTML or ARIA content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill explicitly utilizes tools to generate and execute code at runtime to interact with the browser.
Evidence: The run_code tool is used to execute CodeceptJS snippets generated by the agent based on its inspection of the page.
Evidence: The evaluate method is documented for executing browser-side functions, allowing arbitrary JavaScript execution within the target page context.

codeceptjs-exploration