The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external web applications through the simulator's console logs and screenshots, which creates a surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent's context via the /api/console and /api/screenshot/webview endpoints as described in SKILL.md.
Boundary markers: The skill does not provide explicit delimiters or instructions to help the agent distinguish between simulator output and its own operating instructions.
Capability inventory: The skill allows the use of high-privilege tools including Bash, Write, and Edit, which could be abused if an injection attack is successful.
Sanitization: The documentation does not mention any sanitization, filtering, or validation of the content retrieved from the simulator.

simulator-automation