The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill makes extensive use of dynamic await import() statements within scripts/ego-jev.mjs and the CLI wrapper. This is a technical requirement to bypass limitations in the ego-browser nodejs runtime regarding static module imports.
[DYNAMIC_EXECUTION]: The benchmarking utility run-pair.sh uses sed to dynamically inject configuration parameters and API credentials into temporary JavaScript files (arm-a.js, arm-b-step.js) before executing them. This allows the skill to pass configuration into the restricted ego runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from web pages to drive browser actions, creating a potential surface for indirect prompt injection.
Ingestion points: Web page elements and accessibility tree snapshots are parsed in parseActionTargets within scripts/ego-jev.mjs.
Boundary markers: The skill structures web data into a specific "element table" format before transmission to the Jev model, which helps isolate data from instructions.
Capability inventory: The skill has the capability to perform browser actions including page.click, page.fill, page.press, and page.evaluate (specifically for scrolling).
Sanitization: Element names and values are truncated to 60 characters, and target selection is limited to the top 40 interactive elements to reduce the attack surface.
[CREDENTIALS_UNSAFE]: The skill reads API keys from ~/.config/typesafe/api_key and references other sensitive files like ~/.pi/agent/auth.json in its configuration examples. This file-based credential management is explicitly documented as a security best practice for the ego-browser environment to prevent sensitive data from leaking through process environment variables.
[COMMAND_EXECUTION]: The install.sh script and the scripts/ego-jev CLI execute shell commands for environment setup, including ln for symlinking, chmod 600 for securing credential files, and invoking the ego-browser executable.
[EXTERNAL_DOWNLOADS]: The documentation recommends installation via npx skills add jiangkoumo/ego-jev, which fetches the skill and its dependencies from external repositories.

ego-jev