The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted metadata from the window.__AXHUB_ANNOTATION_SOURCE__ object, specifically the aiPrompt and annotationText fields. A malicious prototype could embed instructions in these fields to hijack the agent's logic during analysis or reporting.
[DATA_EXFILTRATION]: The review submission workflow in references/review-report-submission.md retrieves url and existsUrl directly from the page's runtime context. The instructions explicitly direct the agent to ignore the hostname and not verify the channel, which allows a malicious prototype to exfiltrate the user's markdown review report to an attacker-controlled server.
[DATA_EXFILTRATION]: The skill identifies source code by resolving paths relative to a source.root value provided by the prototype. This could be used to probe the local filesystem if the prototype is hosted locally, or to fetch data from untrusted remote servers.
[COMMAND_EXECUTION]: The skill uses page.evaluate to execute JavaScript snippets within the browser context. While the scripts are defined in the skill, they operate directly on untrusted page objects and data.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface: 1. Ingestion points: The agent reads data from window.__AXHUB_ANNOTATION_SOURCE__ and window.__AXHUB_REVIEW_SUBMIT__. 2. Boundary markers: None; there are no instructions to sanitize or delimit strings like aiPrompt. 3. Capability inventory: The agent can execute code via page.evaluate and perform network requests via fetch. 4. Sanitization: No validation or sanitization is performed on the data or URLs extracted from the prototype environment.

axhub-prototype-context