The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external content (URLs or web files) through a headless browser environment managed by assets/cdp-qa.mjs. This creates an attack surface where malicious content on targeted pages could attempt to influence the agent's decision-making process.
Ingestion points: The assets/cdp-qa.mjs script loads arbitrary URLs or local file paths into a browser instance.
Boundary markers: Instructions in SKILL.md explicitly warn the agent to treat DOM and reviewer data as untrusted.
Capability inventory: The skill environment can launch local processes (spawn), perform network requests (fetch), and write persistent evidence files to the filesystem.
Sanitization: The assets/release-gate.mjs script uses a redaction layer (redactUntrusted) to strip sensitive patterns like machine paths and secrets before reporting results.
[COMMAND_EXECUTION]: The assets/cdp-qa.mjs script launches local browser processes (Chrome, Edge, or Chromium) using system-wide executable path lookups and environment variables such as CHROME_PATH.
[DYNAMIC_EXECUTION]: The skill performs dynamic JavaScript execution in the browser context via the Chrome DevTools Protocol (Runtime.evaluate) to execute auditing probes and collect measurements from rendered artifacts.
[DATA_EXFILTRATION]: The assets/cdp-qa.mjs script performs network requests to non-whitelisted domains while verifying the status of external links discovered within the target artifact using the fetch API.

tastecheck-pass