The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection (Category 8) by fetching and processing content from arbitrary, untrusted external URLs.\n
Ingestion points: External data enters the agent context in SKILL.md during the 'verify' and 'cobrowse' modes, specifically via mcp__claude-in-chrome__get_page_text, mcp__claude-in-chrome__read_page, and the claim-verifier subagent.\n
Boundary markers: The instructions do not define explicit boundary markers or "ignore embedded instructions" directives to isolate the retrieved source content from the agent's logic.\n
Capability inventory: The skill has access to significant capabilities, including local file system modification via Bash, Write, and Edit tools, as well as browser automation via the claude-in-chrome suite, which could be abused if the agent is compromised by injected content.\n
Sanitization: There is no documentation of sanitization, filtering, or validation applied to the fetched remote content before it is processed by the LLM.

claims