The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to navigate to and process content from external websites, which serves as an entry point for malicious instructions.
Ingestion points: Content is ingested through accessibility tree snapshots (agent-browser snapshot -i) and page text extraction as described in SKILL.md.
Boundary markers: The instructions do not include boundary markers or warnings to the agent to disregard instructions found within web content.
Capability inventory: The agent has the capability to execute shell commands (agent-browser, ffmpeg), perform file system operations via agent-fs, and interact with external APIs (GitHub, Linear, Slack) as noted in SKILL.md.
Sanitization: No sanitization or validation of ingested web data is mentioned in the skill files.
[COMMAND_EXECUTION]: The skill relies on executing the agent-browser CLI tool and ffmpeg for processing video recordings.
[PRIVILEGE_ESCALATION]: Chromium is explicitly configured to launch with the --no-sandbox flag. This disables a key security boundary in the browser, potentially allowing a malicious website to exploit the browser and affect the host environment more easily, though this is a known requirement for many headless CI/CD environments.

agent-browser