The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions acknowledge that web content and external data ingested via BrowserOS are treated as hostile, identifying an attack surface for indirect injections.
Ingestion points: External web content and data retrieved through the BrowserOS tool.
Boundary markers: No explicit delimiters for untrusted input are defined, though operational modes are established.
Capability inventory: The skill possesses terminal execution capabilities via the ExecutionProxy and file-writing capabilities via the MemoryStore interface.
Sanitization: The instructions mandate the redaction of secrets and PII before sharing context with subagents.
[COMMAND_EXECUTION]: The framework requires all terminal actions to be performed via an ExecutionProxy Interface (e.g., rtk npm test), which involves executing shell commands within the environment for TDD and build processes.
[DATA_EXFILTRATION]: While not performing exfiltration, the skill accesses local project metadata such as package.json and internal architecture maps (docs/graph.json) to verify environment context. The security protocol explicitly instructs the agent to redact sensitive information before context sharing.

perseus