The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to operate a browser and read web content, which exposes the agent to indirect prompt injection attacks where malicious instructions are hidden in third-party websites.
Ingestion points: The skill reads element text, attributes, and DOM structures during browser operations (SKILL.md, references/platform-operations.md).
Boundary markers: While no specific data delimiters are enforced, the skill contains explicit instructions for the agent to treat all webpage content as untrusted.
Capability inventory: The agent can navigate, submit forms, upload/download files, write local evidence artifacts, and execute local validation scripts.
Sanitization: references/usage.md contains strong directives to ignore instructions found in webpage text and to stop immediately if secret access or security bypasses are requested.
[COMMAND_EXECUTION]: The skill includes three Python scripts (scripts/preflight-local-browser-workspace.py, scripts/resolve-local-browser-route.py, and scripts/validate-frontend-visual-evidence.py) used for configuration resolution and evidence validation. These scripts are restricted to processing local JSON files and use standard library modules, with no identified network or arbitrary code execution capabilities.

ops-browser