The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites specified as the target URL, creating a surface for indirect prompt injection attacks.
Ingestion points: SKILL.md details how the agent should ingest content via browser_snapshot(), browser_vision(), and browser_console() calls.
Boundary markers: There are no explicit instructions or delimiters used to warn the agent to ignore potential instructions embedded within the webpage content or console logs.
Capability inventory: The agent possesses browser interaction capabilities (browser_click, browser_type, browser_press) and the ability to write reports and screenshots to the local file system as defined in Phase 5 of SKILL.md.
Sanitization: The skill does not describe any sanitization or validation mechanisms for the text and console data retrieved from the browser before it is processed by the model.

dogfood