The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data (email bodies and Teams messages) which presents an indirect prompt injection surface. This is mitigated by the use of AGENT_BROWSER_CONTENT_BOUNDARIES=1 to wrap page-sourced content in nonce-based markers, allowing the calling agent to distinguish data from instructions. Ingestion points include lib/read.js, lib/digest.js, lib/teams.js, and lib/copilot.js. Capability inventory includes subprocess calls via agent-browser and eval in the browser context. Sanitization is performed by content boundary markers to prevent interpreting data as instructions.
[COMMAND_EXECUTION]: The skill executes shell commands and browser-side JavaScript to perform automation and data extraction. lib/run.js uses spawnSync to invoke the agent-browser CLI tool. lib/search.js, lib/read.js, and lib/calendar.js use eval to extract structural identifiers (e.g., data-convid) and perform UI interactions. These scripts are hardcoded and not derived from untrusted input.
[DATA_EXFILTRATION]: The skill is designed to read sensitive communication data (emails, calendar events, and chat messages) and return it to the calling AI agent. To prevent abuse, it implements a default-deny Action Policy at the browser layer (e.g., policy-read.json, policy-search.json) which ensures operations are strictly read-only and blocks all data-modifying actions like sending or deleting.

outlook-web