The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface for indirect prompt injection by design, as it fetches and processes content from external websites.
Ingestion points: Tools such as navigate_page and get_page_content in SKILL.md and references/browser-api.md allow the agent to read arbitrary web data.
Boundary markers: There are no instructions to use delimiters or specific tags to prevent the agent from mistaking website content for system instructions.
Capability inventory: The skill includes high-privilege automation actions such as click, type, and evaluate_javascript (documented in references/commands.md), which could be exploited if a malicious page successfully injects instructions.
Sanitization: The skill does not provide methods for sanitizing or escaping the data retrieved from pages before processing.
[COMMAND_EXECUTION]: The skill's documentation includes instructions for users to run local shell commands to facilitate the browser automation environment.
Evidence: SKILL.md and references/installation.md provide command-line examples for starting Chrome with remote debugging enabled (--remote-debugging-port=9222) and for process management (taskkill, pkill).
[DYNAMIC_EXECUTION]: The skill uses JavaScript evaluation as its primary method for interacting with and extracting data from web pages.
Evidence: The evaluate command and corresponding tool mcp__chrome-devtools-mcp_evaluate_javascript (detailed in references/browser-api.md) are used to execute dynamic script templates in the browser's context.

chrome-browser