The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and act upon content from external web pages, creating a significant attack surface for indirect prompt injection.
Ingestion points: The agent ingests data through accessibility snapshots and full page content extraction (e.g., in Recipes/SummarizePage.md and Workflows/ReviewStories.md).
Boundary markers: No explicit delimiters or boundary markers are defined to help the agent distinguish between its instructions and the data retrieved from the web.
Capability inventory: The skill can execute shell commands via the chrome-devtools-axi CLI, write files (screenshots) to the /tmp/ directory, and execute JavaScript within the browser context.
Sanitization: There is no evidence of sanitization, filtering, or validation of the web content before it is passed to the LLM for analysis or action.
[DYNAMIC_EXECUTION]: The skill contract includes an eval command that allows the agent to execute arbitrary JavaScript strings within the browser. While intended for tasks like inspecting document.title, this capability could be abused if an attacker can influence the script string via prompt injection or if the agent executes scripts derived from untrusted page content.
[COMMAND_EXECUTION]: The skill relies on executing the local binary /opt/homebrew/bin/chrome-devtools-axi. The Workflows/Update.md workflow includes instructions to run update --check, which performs external network operations to check for tool updates, and test -x, which checks file permissions.

do-browser