The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses JavaScript REPL tools (mcp__cua_repl__js and mcp__node_repl__js) to execute code on the host system. It specifically instructs the agent to dynamically import a script using a path determined at runtime (<plugin root>/scripts/browser-client.mjs) and to store objects in the global scope (globalThis.agent, globalThis.iab) for persistent access across tool invocations.
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface for indirect prompt injection as it is designed to browse, inspect, and interact with external web content.
Ingestion points: The agent retrieves and processes the content of web pages visited via the in-app browser.
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between its original instructions and potentially malicious instructions embedded in the web pages it visits.
Capability inventory: The agent has the ability to navigate the browser, click elements, type text, take screenshots, and execute arbitrary JavaScript in the host environment via the provided REPL tools.
Sanitization: No sanitization, validation, or filtering mechanisms are described for the data retrieved from external websites before it is processed by the agent or used in subsequent operations.
[COMMAND_EXECUTION]: By design, the skill provides the agent with access to JavaScript REPLs (mcp__cua_repl__js, mcp__node_repl__js). Depending on the capabilities exposed to these REPL environments, the agent may be able to execute system-level commands or access the local filesystem beyond the scope of the browser plugin.

codex-in-app-browser