The Agent Skills Directory

[COMMAND_EXECUTION]: The skill leverages high-privilege environment tools such as chrome:control-chrome and computer-use:computer-use to operate the user's browser. It is designed to navigate the ChatGPT UI, interact with the composer, and extract assistant responses by automating clicking and typing actions. While these tools have broad capabilities, the skill contains explicit constraints to use them only within the context of the official ChatGPT website.
[DATA_EXFILTRATION]: The skill performs network operations by accessing chatgpt.com. This is the intended primary function for research purposes. To mitigate privacy risks, the skill includes strict instructions forbidding the inspection of sensitive browser data, including cookies, local storage, passwords, browser profiles, or session stores. It reads content from the web and saves it locally to the <WORKSPACE>/reports/ directory.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests and processes untrusted data from an external source (responses from chatgpt.com).
Ingestion points: Content is extracted from the assistant role on the active ChatGPT tab (SKILL.md, Step 10).
Boundary markers: The skill implements a security boundary by requiring a unique UUID completion marker ([[CHATGPT_WEB_RESEARCH_DONE_<uuid>]]) to be present in the assistant's output before the research is considered complete.
Capability inventory: The skill has the capability to write files to the local workspace via Markdown report generation.
Sanitization: There is no explicit sanitization of the content extracted from the web page during the reconstruction of the Markdown report, relying instead on the verification of the completion marker.

chatgpt-web-research