The Agent Skills Directory

[DATA_EXFILTRATION]: The skill allows the agent to retrieve sensitive information from the browser. The get_network_log and get_websocket_log tools in SKILL.md capture HTTP response bodies and WebSocket frames respectively. Furthermore, get_query_data provides access to the TanStack React Query cache. If used while the user is logged into private services (e.g., email, banking, or internal tools), the agent can access private data returned by APIs.
[COMMAND_EXECUTION]: The skill documentation in SKILL.md references a local installation process via bash install.sh, which involves executing shell commands to set up the MCP server and browser extension.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection.
Ingestion points: SKILL.md defines tools like page_snapshot, get_network_log, and get_websocket_log that ingest untrusted data from external web pages into the agent's context.
Boundary markers: There are no boundary markers or system instructions in SKILL.md to ignore instructions embedded in the captured data.
Capability inventory: While this specific skill is read-only, it is explicitly designed to be used in conjunction with the Chrome DevTools MCP server, which possesses 'act' capabilities (clicking, typing, navigating), creating a high-risk surface if the agent follows instructions found in inspected web content.
Sanitization: No sanitization or filtering logic is specified in SKILL.md to prevent adversarial content from being processed by the model.

dashpilot