The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes an indirect prompt injection attack surface.
Ingestion points: scripts/cdp.mjs retrieves untrusted data from browser tabs via HTML snapshots, accessibility tree trees, and JavaScript evaluation results.
Boundary markers: No delimiters or specific instructions are provided to the agent to treat browser-provided data as untrusted content.
Capability inventory: The skill provides capabilities for browser navigation, element interaction (click/type), and arbitrary code execution within the browser session.
Sanitization: No sanitization or filtering of the content retrieved from web pages is performed before it enters the agent's context.
[COMMAND_EXECUTION]: The skill provides high-impact primitives such as eval and evalraw which allow the execution of arbitrary JavaScript and DevTools Protocol commands. While these are intended features for browser debugging, they represent a significant risk if an agent is tricked into using them maliciously after being compromised by external web content.

chrome-cdp