The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/teams.js is vulnerable to shell command injection. The chatId argument is interpolated directly into a string passed to execSync without any sanitization, quoting, or validation.
Evidence: execSync(node "${BROWSER_JS}" goto ${chatUrl}, { ... }) in scripts/teams.js where chatUrl is built using the chatId argument.
[DYNAMIC_EXECUTION]: The skill makes extensive use of dynamic JavaScript generation and execution.
It generates complex JS snippets at runtime (e.g., WAIT_DOM_JS, OBSERVE_JS, WAIT_FOR_JS) and executes them in the browser context via playwright-cli eval.
It implements a custom RPC mechanism over unix sockets in scripts/helper.js to communicate directly with the playwright-cli daemon, bypassing standard CLI overhead.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest data from arbitrary websites and present it to the agent, creating a large surface for indirect prompt injection.
Ingestion points: scripts/browser.js via snapshot, find, observe, and eval commands.
Boundary markers: Absent. While documentation in SKILL.md and sites/CONTRIBUTING.md instructs the agent to paraphrase content and avoid verbatim transcription, there are no programmatic delimiters or "ignore instructions" wrappers for the ingested data.
Capability inventory: High-risk capabilities including local shell execution (via the injection in teams.js), file writing (save-state), and unrestricted network access via the automated browser.
Sanitization: No technical sanitization or filtering is performed on data retrieved from the browser before it enters the agent's context.
[EXTERNAL_DOWNLOADS]: The browser.js script includes an update check mechanism that performs network operations to reach external repositories.
Evidence: The checkForUpdate and checkGitBehind functions execute git fetch origin to check for updates.

browser-automation