The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for interacting with external web content, which represents an ingestion surface for untrusted data.
Ingestion points: Untrusted data from external web pages enters the agent's context through tools like browser_query, browser_snapshot, and browser_get_tabs described in SKILL.md.
Boundary markers: The skill does not prescribe the use of specific boundary markers or "ignore instructions" prompts to isolate untrusted web content from the agent's core instructions.
Capability inventory: The skill enables capabilities such as navigating to arbitrary URLs, clicking elements, typing into inputs, and selecting options, which could be abused if an injection is successful.
Sanitization: The instructions do not include guidance for sanitizing or validating the text and metadata extracted from the browser before it is processed by the agent.

browser-automation