The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/capture.mjs script uses the Chrome DevTools Protocol Runtime.evaluate method to execute JavaScript strings within the browser context. These strings are derived from command-line arguments and environment variables.\n- [COMMAND_EXECUTION]: The scripts/capture.mjs script contains a JavaScript injection vulnerability where the WAIT_FOR environment variable is directly interpolated into an evaluation string: evaluate(`(()=>{try{return !!(${process.env.WAIT_FOR})}catch{return false}})()`). This lacks proper sanitization, potentially allowing an attacker to execute arbitrary JavaScript in the browser if they can influence the agent's environment.\n- [DATA_EXFILTRATION]: By allowing the agent to capture screenshots of any URL and send them to the user, the skill creates a path for data exfiltration. An agent could be directed to capture sensitive internal pages, local system files, or authentication-heavy views, resulting in the unauthorized export of sensitive data as images.\n- [INDIRECT_PROMPT_INJECTION]: The skill presents a significant surface for indirect prompt injection as it instructions the agent to visit external websites and analyze the resulting images and console logs.\n
Ingestion points: External URLs visited by scripts/capture.mjs and the console errors printed to the agent's context.\n
Boundary markers: None identified in the prompt instructions to distinguish between trusted instructions and external page content.\n
Capability inventory: The skill has the ability to spawn processes, write to the filesystem, and perform network navigation via a headless browser.\n
Sanitization: No evidence of sanitization or validation of the content retrieved from external URLs before it is processed by the agent.

workflow-progress-screenshots