The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches text and HTML content from external websites and provides it to the AI agent. This introduces a vulnerability surface where a malicious website could include hidden instructions designed to manipulate the agent's behavior or exfiltrate data from the current session.
Ingestion points: The runtime/webfetch-plus.mjs script ingests data via page.goto(options.url) and extracts text content.
Boundary markers: There are no specific delimiters or 'ignore' instructions added to the fetched content before it is processed by the AI.
Capability inventory: The skill has access to shell execution (bash, node), the ability to write files to /tmp, and full network access.
Sanitization: The skill removes scripts, styles, and other non-textual elements, which reduces some risk, but it does not sanitize natural language instructions within the remaining text.
[EXTERNAL_DOWNLOADS]: The skill performs automatic software updates and asset downloads during operation.
Dependency Installation: The bin/wfp.sh script executes npm install for the cloakbrowser and playwright-core packages if the node_modules directory is missing.
Browser Downloads: When utilizing the --stealth flag, the skill may download a patched Chromium binary required for bot-detection bypass.
[DATA_EXFILTRATION]: The skill manages sensitive authentication data in the local file system.
Session Exposure: Authentication states (cookies and localStorage) are stored in /tmp/wfp-states/ when using the --save-state option or the manual verification tool. While this is standard for session persistence, these files may contain sensitive credentials that could be accessed by other users on the same system depending on the environment's /tmp permissions.
[COMMAND_EXECUTION]: The skill utilizes shell scripts and operating system utilities to perform its tasks.
Interactive TTY: The bin/wfp-human.sh script uses osascript on macOS to launch a new Terminal window for manual human verification (solving CAPTCHAs or logging in). Arguments passed to this script are handled using environment variables and shell quoting to prevent command injection.

webfetch-plus