The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reveals author-specific environment details by hardcoding an absolute file path in references/launching.md (/Users/frog/.hermes/hermes-agent/node_modules/playwright/index.mjs). This disclosure provides information about the local file system structure and internal tool names.
[COMMAND_EXECUTION]: Browser automation instructions in references/launching.md utilize the --remote-debugging-port flag and launchPersistentContext. These configurations allow for the browser instance to be controlled or inspected via a local network port, posing a risk of unauthorized access to the automation session.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and acts upon data from untrusted external websites.
Ingestion points: Browser DOM content is read via document.querySelectorAll and waitForFunction in SKILL.md and references/workflow.md.
Boundary markers: No markers or warnings to ignore embedded instructions are present.
Capability inventory: The skill has high privileges, including browser automation, script execution in page contexts (page.evaluate), and file system cleanup operations.
Sanitization: External text content is matched via regular expressions (/[\u3400-\u9FFF]/) without sanitization or filtering of potential control sequences.

extension-real-browser-testing