The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the run execute command which allows the execution of arbitrary JavaScript code within a sandbox. This is used for batching tool calls and direct browser interaction through the Playwright API (page object).
[COMMAND_EXECUTION]: The skill manages "scenarios," which are reusable JavaScript scripts stored in .ironbee-devtools/scenarios.json. These scripts are executed in the same environment as the execute tool.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the web (HTML, text, accessibility snapshots).
Ingestion points: Untrusted data enters the agent context through tools like navigation_go-to, content_get-as-text, content_get-as-html, and a11y_take-aria-snapshot.
Boundary markers: No explicit instructions or delimiters are provided to the agent to ignore instructions embedded in the retrieved web content.
Capability inventory: The agent has extensive capabilities including arbitrary JavaScript execution (run execute), browser control, network request interception (stub), and file system writes (screenshots, scenarios).
Sanitization: The content_get-as-html tool provides options to remove scripts, styles, and comments, but these are for output cleaning rather than preventing adversarial instruction execution by the LLM.

ironbee-browser-devtools-cli