The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_slides_cdp.py uses the --ready-expr command-line argument to execute arbitrary JavaScript within the browser context via the Chrome DevTools Protocol (CDP). The argument is interpolated directly into a JS string in the wait_for_ready function without sufficient sanitization, potentially allowing JS injection if the agent is manipulated into passing a malicious expression.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted HTML files. These files are rendered in a full browser environment (headless Chrome/Edge) using automation scripts (onepage_pdf.py and render_slides_cdp.py). This creates a surface where malicious instructions embedded in the HTML could attempt to influence the agent's behavior or exploit browser capabilities.
Ingestion points: Processes HTML files via the input argument in both core scripts.
Boundary markers: None detected for isolating untrusted HTML content within the rendering pipeline.
Capability inventory: Execution of shell commands (launching browsers) and browser automation (JS evaluation, screenshots, PDF generation).
Sanitization: No visible sanitization of HTML content before rendering.
[COMMAND_EXECUTION]: Both onepage_pdf.py and render_slides_cdp.py execute shell commands using subprocess.run and subprocess.Popen to launch browser instances. While paths are resolved using standard search patterns, the reliance on system-level executables is a necessary but sensitive capability.

html-to-pdf