The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and examples utilize npx chrome-use, which triggers the download and execution of packages from the npm registry. The source of this package is not a recognized trusted organization.
[REMOTE_CODE_EXECUTION]: The use of npx allows for the dynamic execution of remote code at runtime. This execution path could be exploited if the package is compromised or substituted.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to automate browser interactions, including chrome-use click, fill, press, and screenshot. It also attempts to connect to local browser debugging ports (e.g., 9222). The skill additionally uses the abs tool for unspecified scripting tasks.
[DATA_EXFILTRATION]: The skill is designed to extract sensitive data from Slack workspaces, including private messages, participant lists, and search results. It explicitly saves this data to local files (e.g., slack-snapshot.json, snapshot.txt) and captures screenshots, which could be subsequently exfiltrated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes arbitrary text from Slack messages which could contain malicious instructions for the agent.
Ingestion points: Slack message content, channel names, and user metadata are read via chrome-use snapshot and chrome-use get text in SKILL.md.
Boundary markers: The instructions do not define clear boundaries or delimiters to separate untrusted Slack content from the agent's system instructions.
Capability inventory: The skill possesses extensive capabilities to interact with the web (clicking, typing, navigating) via the chrome-use tool, providing an execution path for instructions found in Slack messages.
Sanitization: There is no evidence of sanitization, filtering, or validation of the data retrieved from Slack before it is processed by the agent.

slack