The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements web scraping workflows that ingest untrusted data from external websites while possessing high-privilege browser capabilities such as form filling and file downloads. This combination allows for potential manipulation of agent behavior via instructions embedded in processed web content.
Ingestion points: page.goto and various extraction recipes in references/data_extraction_recipes.md and SKILL.md.
Boundary markers: The skill lacks instructions for using delimiters or negative constraints to prevent the agent from following instructions found in scraped content.
Capability inventory: The skill uses the Playwright library to perform clicks, fill inputs, and handle downloads as seen in references/playwright_browser_api.md and scripts/form_automation_builder.py.
Sanitization: A cleaning utility in references/data_extraction_recipes.md handles whitespace and zero-width characters but does not sanitize against prompt injection patterns.
[DYNAMIC_EXECUTION]: The toolkit includes scripts designed to dynamically generate Python source code for web automation tasks based on user-provided parameters.
Evidence: scripts/form_automation_builder.py and scripts/scraping_toolkit.py use string templates and text wrapping to construct executable scripts.
[PRIVILEGE_ESCALATION]: The script generation tools automatically modify file permissions to make the resulting Python scripts executable by the system.
Evidence: os.chmod(output_path, 0o755) is called in scripts/form_automation_builder.py (line 330) and scripts/scraping_toolkit.py (line 195).

browser-automation