The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from web pages, creating a vulnerability surface for indirect prompt injection attacks.
Ingestion points: Data enters the agent's context through the snapshot command (client.py: get_ai_snapshot), which retrieves the ARIA accessibility tree of the current web page.
Boundary markers: The YAML-formatted snapshot is returned to the agent without explicit delimiters or warnings to ignore instructions embedded within the page content (e.g., in text, aria-labels, or image alt-text).
Capability inventory: The skill possesses significant capabilities, including element interaction (click, fill, hover), arbitrary JavaScript execution within the browser context (evaluate command), and the ability to execute full Python scripts via heredocs as documented in SKILL.md and refs/scraping.md.
Sanitization: The snapshot.js script extracts attributes like aria-label, title, and text content without sanitization or filtering for adversarial patterns.
[DYNAMIC_EXECUTION]: The skill provides multiple methods for executing dynamic code at runtime.
The evaluate command in client.py uses page.evaluate() to run arbitrary JavaScript provided as a command-line argument within the browser session.
The SKILL.md and refs/scraping.md files provide instructions and templates for executing arbitrary Python code using shell heredocs (uv run python <<'EOF'), enabling the agent to assemble and run complex scripts on the fly.
[COMMAND_EXECUTION]: The skill relies on the execution of the client.py script via the uv run command for all interactions, which is a standard pattern for this toolset but involves frequent shell command execution by the agent.

browser