The Agent Skills Directory

[PROMPT_INJECTION]: The skill mentions the phrase 'Ignore previous instructions', but it does so defensively. It instructs the agent to treat any such strings found within untrusted browser content (like DOM text or console logs) as data to be reported, rather than instructions to be executed. This is a safety measure designed to prevent the agent from being manipulated by content it observes in the browser.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests that the user configure their environment by installing the chrome-devtools-mcp package from the NPM registry using npx. This is a standard installation pattern for MCP servers.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly identifies and mitigates the risk of indirect prompt injection from browser content.
Ingestion points: The agent ingests data from the browser via DOM inspection, console logs, network monitor, accessibility tree, and JavaScript execution output (found in SKILL.md).
Boundary markers: The skill mandates the use of explicit 'Content Boundary Markers' to separate trusted instructions from untrusted browser data and provides a visual schema for these boundaries.
Capability inventory: The agent has the capability to execute JavaScript in the page context, capture screenshots, and inspect sensitive network/style metadata.
Sanitization: The skill instructs the agent to never interpret browser content as instructions, to verify all navigations with the user, and to flag suspicious content that resembles directives before proceeding.
[DYNAMIC_EXECUTION]: The skill makes use of a JavaScript execution tool to inspect application state. To mitigate risk, it establishes strict execution constraints: the tool is read-only by default, forbidden from making external network requests, and restricted from accessing credentials like cookies or local storage.

browser-testing-with-devtools