The Agent Skills Directory

[COMMAND_EXECUTION]: The backend configuration in the Bun.WebView constructor allows users to specify a custom path to a browser executable and provide arbitrary argv command-line arguments. This functionality allows for the execution of arbitrary binaries on the host system if the path or arguments are derived from untrusted inputs.
[DYNAMIC_EXECUTION]: The evaluate() method executes JavaScript expressions provided as strings within the webview context. If an agent interpolates user data into these expressions without rigorous sanitization, it may lead to cross-site scripting (XSS) or arbitrary code execution within the browser environment.
[DYNAMIC_EXECUTION]: The cdp() method permits sending raw Chrome DevTools Protocol commands. This provides low-level control over the browser backend, which could be leveraged to bypass security policies, access sensitive browser state, or exfiltrate data from the session.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with external websites via navigate() and evaluate(). This creates an attack surface for indirect prompt injection, where malicious instructions hidden in a website's HTML, metadata, or scripts could attempt to manipulate the agent's behavior when it processes the page content.
Ingestion points: URL navigation via view.navigate() and DOM content extraction via view.evaluate().
Boundary markers: None implemented; content is processed directly within the webview.
Capability inventory: File system writes (screenshots), network access (navigation), and arbitrary script execution (evaluate).
Sanitization: The skill documentation does not provide guidelines for sanitizing or escaping content retrieved from external URLs.

bun-webview