The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external web pages, which is a potential vector for indirect prompt injection attacks. 1. Ingestion points: Rendered structure, page text, console output, and network content obtained via open_canvas or Playwright tools (SKILL.md, WORKFLOW.md). 2. Boundary markers: The instructions explicitly mandate treating all page data as untrusted and warn not to interpret it as new instructions. 3. Capability inventory: The agent can read repository files, perform browser actions, and execute diagnostic JavaScript. 4. Sanitization: The skill restricts JavaScript to read-only operations and strictly forbids dumping sensitive information like credentials or full DOM contents.
[DYNAMIC_EXECUTION]: The skill allows the agent to generate and execute JavaScript snippets within the browser environment for tasks that structured actions cannot perform. Evidence: The workflow allows agent-authored JavaScript for read-only diagnostics. Mitigation: Explicit prohibitions against mutating application state or using JS as a substitute for real user interactions or security-sensitive actions.
[COMMAND_EXECUTION]: The skill uses Playwright MCP and other browser adapters to perform automated interactions. Evidence: Fallback logic is defined to switch to Playwright MCP if the primary browser canvas is unavailable. Mitigation: The skill enforces isolation by requiring fresh browser sessions that do not inherit cookies, profiles, or authentication from the host.

browser-canvas-validation