The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external desktop applications.
Ingestion points: The agent reads UI snapshots and text content from Electron applications (e.g., Slack, VS Code) using the agent-browser snapshot and agent-browser get text commands in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between its instructions and the data/text found within the automated applications.
Capability inventory: The agent has access to the Bash tool, allowing it to execute shell commands, and the agent-browser tool, which allows for complex interaction with the target application (clicking, typing, form filling).
Sanitization: The skill lacks mechanisms to sanitize or filter the content retrieved from applications before processing it.
[COMMAND_EXECUTION]: The skill utilizes shell commands to launch applications with specific flags and to interact with them via the agent-browser CLI tool. This capability provides the agent with control over local applications and the host system environment.
[EXTERNAL_DOWNLOADS]: The skill uses npx to execute agent-browser, which may involve fetching the package from the official npm registry. This is documented neutrally as it is a common practice for Node.js-based automation tools.

electron