The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests untrusted data from external websites and provides powerful browser interaction capabilities.
Ingestion points: Numerous tools ingest content from the web, including scrape_url, read_page, scrape_markdown, scrape_text, scrape_json, batch_scrape, crawl_site, and extract_structured.
Boundary markers: The instructions do not define clear delimiters or warning markers for the agent to distinguish between the skill's instructions and the scraped web content.
Capability inventory: The skill allows for significant browser interaction through tools like browser_click, browser_type, and browser_eval, as well as file output via the --output flag in batch commands.
Sanitization: There is no evidence of sanitization or filtering of the scraped content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The browser_eval tool (mapped to gologin-web-access eval) allows the agent to execute arbitrary JavaScript expressions within the context of a live browser tab. While this is a standard feature for browser automation, it constitutes a dynamic execution vector if the agent is manipulated into executing malicious scripts.

gologin-web-access-skill