The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external targets, including HTML DOM snapshots, API responses (JSON/GraphQL), JavaScript bundles, and unpacked application binaries. This creates a vulnerability surface for indirect prompt injection, where a malicious target could embed instructions within these artifacts to influence the agent's behavior.
Ingestion points: The skill utilizes agent-browser to capture DOM content, HAR files, and React framework state, and it uses asar to extract content from local binaries.
Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted target data from the agent's core instructions, increasing the risk that embedded directives might be obeyed.
Capability inventory: The agent has access to the Bash shell (via allowed-tools) and the ability to write reports and configuration files to the local file system.
Sanitization: The instructions do not specify a process for sanitizing or escaping the content retrieved from external targets before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill relies on external tools and libraries to perform its tasks, including agent-browser (accessed via npx), the surfacer compiler for IR validation, and the cheerio library for HTML parsing.
[COMMAND_EXECUTION]: The skill frequently instructs the agent to execute shell commands using the agent-browser CLI to automate browser interactions, record network traffic, and extract data from various application formats.

surface-recon