The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted content from the public web, which creates a surface for indirect prompt injection attacks.
Ingestion points: Web content enters the agent context via multiple tools including WebFetch, curl, lightpanda, agent-browser, and Playwright MCP, as described in SKILL.md and references/extraction-patterns.md.
Boundary markers: The instructions do not mandate the use of explicit delimiters or "ignore embedded instructions" warnings when presenting untrusted content to the LLM.
Capability inventory: The skill possesses extensive capabilities, including shell command execution, file system writes for saving extracted content, and interactive browser automation (clicks, form fills, and JavaScript evaluation).
Sanitization: The skill reduces the attack surface by instructing the agent to strip boilerplate (nav, ads, footers) and to convert content into Markdown or Semantic Tree formats rather than raw HTML.
[EXTERNAL_DOWNLOADS]: In references/tool-setup.md, the skill provides instructions to download the Lightpanda browser binary from GitHub. The provided shell script includes a robust security measure that verifies the file's SHA-256 integrity using Python before the binary is installed.
[COMMAND_EXECUTION]: The skill operates by executing various command-line utilities (curl, lightpanda, agent-browser) to fetch and interact with web pages. These are within the intended functional scope of the skill.
[DYNAMIC_EXECUTION]: The skill uses browser-level JavaScript execution (the evaluate tool) to extract structured data from pages at runtime. While this is a standard feature of browsing tools, it represents the execution of dynamic logic within the browser context.

browse