The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites via the EXPLORE_CANDIDATES and EXPLORE_HTML fields generated by the exploration script. This is identified as a vulnerability surface where a malicious website could attempt to influence the agent's behavior.
Ingestion points: Content is extracted from the DOM of target URLs and displayed in the agent's console logs as described in SKILL.md and references/explore.md.
Boundary markers: The instructions explicitly warn the agent that the dump is untrusted and to ignore any instructions (e.g., "ignore previous instructions") found within the web content.
Capability inventory: The agent can execute the generated test scripts via k6 run and perform file operations using mktemp and cp.
Sanitization: The skill extracts specific element attributes into a structured JSON format (EXPLORE_CANDIDATES) to reduce the likelihood of the agent accidentally obeying free-text instructions found on the page.
[COMMAND_EXECUTION]: The skill uses a POSIX shell to execute several commands including k6, mktemp, cp, and env. These are used to manage the testing environment, resolve dependencies, and run the k6 binary. This behavior is consistent with the tool's purpose and is associated with the official vendor.
[DYNAMIC_EXECUTION]: The skill dynamically assembles an exploration script (explore.js) by appending actions to a template and then executes it using k6 run. This is the primary mechanism for its site exploration and selector verification feature.
[EXTERNAL_DOWNLOADS]: The generated test files and scaffolds download utility libraries from https://jslib.k6.io/, which is the official and well-known hosting service for k6 community and helper libraries.

k6-browser-test