The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by accessing a live Gmail inbox to retrieve OTP codes, creating a surface for indirect prompt injection.
Ingestion points: The skill instructs the agent to navigate to mail.google.com and use chrome_evaluate_script or chrome_take_snapshot to read email content and previews (SKILL.md).
Boundary markers: The instructions include security reminders to not log sensitive data, but there are no formal delimiters or specific instructions for the agent to ignore potentially malicious prompts embedded within email bodies or subjects.
Capability inventory: The skill utilizes chrome_navigate_page, chrome_fill, chrome_click, and chrome_evaluate_script for browser automation, as well as gh pr comment for writing to GitHub and vercel CLI for deployment management.
Sanitization: While the extraction of the OTP is limited by a JavaScript regex (/\b\d{6}\b/), the agent is still exposed to the full text of the emails, which could contain adversarial instructions targeting the agent's broad tool permissions.
[COMMAND_EXECUTION]: The skill executes shell commands using the Vercel and GitHub CLI tools.
Evidence: The skill uses vercel ls, vercel inspect, and gh pr comment to manage deployments and report results.
Context: These actions are consistent with the stated purpose of testing feature branches, but they represent a powerful capability that could be abused if the agent is influenced by malicious external input.

test-staging-branch