The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it navigates to external URLs and returns raw accessibility snapshots and titles to the agent context.
Ingestion points: External URLs processed in screenshotUrl, snapshotUrl, and fillAndSubmitForm (SKILL.md).
Boundary markers: None identified; the skill does not wrap retrieved web content in delimiters or include warnings to ignore embedded instructions.
Capability inventory: The skill can execute arbitrary commands within the microVM (sandbox.runCommand), access Vercel environment variables, and perform network operations.
Sanitization: No sanitization or filtering is performed on the data retrieved from the automated browser sessions.
[COMMAND_EXECUTION]: The skill executes shell commands using sandbox.runCommand to install system libraries and manage the browser lifecycle. These operations are performed within an ephemeral Vercel microVM, limiting the impact to the isolated sandbox environment.
[EXTERNAL_DOWNLOADS]: The skill downloads Chromium system dependencies and the chrome-use library from official package registries (npm) and system repositories (dnf) during initialization.

vercel-sandbox