The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest data from previous work sessions and hidden DOM elements to maintain workflow continuity and retrieve context-specific guidance. This creates a surface where malicious instructions stored in entity descriptions or session summaries could be processed by the agent.
Ingestion points: SKILL.md, references/api-reference.md, and references/examples.md describe retrieval of data via agentAPI.session.get() and document.querySelector('[data-testid="llm-instructions"]').textContent.
Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present in the retrieval patterns.
Capability inventory: The skill has access to Bash (playwright-cli, node, npx) and the ability to write to the local filesystem via shell redirection.
Sanitization: No sanitization or validation of the retrieved session summaries or DOM text is performed before the agent processes the content.
[DYNAMIC_EXECUTION]: The skill's primary operation involves executing JavaScript strings within a browser context using eval via the playwright-cli tool. It also includes a pattern for restoring backups that involves reading a local file and inlining its contents into an execution string.
Evidence: SKILL.md contains instructions for the agent to run node scripts/browser.js exec eval "agentAPI.export.import($(cat agent/desk-backup.json))", which dynamically assembles a command from local file content.

agent-desk