The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting the DOM structure and Accessibility Tree of external websites into the agent's context using the fs command group. This creates a surface for indirect prompt injection, where a malicious website could include instructions intended to manipulate the agent's behavior. The skill author explicitly warns about this possibility in the 'Security Considerations' section, noting that attackers could craft manipulative ARIA labels or use hidden elements.
Ingestion points: fs ls, fs cat, and fs grep commands in SKILL.md retrieve data from untrusted external sources.
Boundary markers: The skill instructions do not utilize specific delimiters or boundary markers to isolate external DOM data from agent instructions.
Capability inventory: The skill provides extensive capabilities including navigation (page open), element interaction (act click), and data entry (act type).
Sanitization: While the documentation suggests sanitizing or filtering DOM content, the skill itself acts as a transparent interface for the browser data.
[EXTERNAL_DOWNLOADS]: The installation instructions require downloading the @apireno/domshell package via npx and the DOMShell extension from the Chrome Web Store. These are core components of the described automation framework.
[PROMPT_INJECTION]: Static analysis flagged the phrase 'Ignore previous instructions', however, this is a false positive as it appears within the 'Security Considerations' section as an example of a potential attack from a malicious website, rather than an attempt by the skill itself to override agent guidelines.

cli-anything-browser