The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate to and process content from external websites, creating a surface for instructions embedded in web pages to influence the agent.
Ingestion points: Untrusted data enters the agent context through the browser_navigate, browser_take_screenshot, browser_snapshot, and browser_console_messages tools (SKILL.md).
Boundary markers: The skill lacks explicit markers or instructions to isolate or disregard potentially malicious instructions found within the processed web content.
Capability inventory: The skill possesses the ability to perform browser actions such as browser_click, browser_hover, and further navigation via browser_navigate (SKILL.md).
Sanitization: While no specific data sanitization is mentioned, the skill instructions mandate using AskUserQuestion to get explicit approval before making modifications, providing a human-in-the-loop safeguard.
[DATA_EXFILTRATION]: The skill utilizes tools that can access and return sensitive information from the browser environment to the agent's context.
Evidence: The tool browser_console_messages returns all console output, which frequently contains sensitive information like session tokens, API keys, or internal logs (SKILL.md).
Evidence: The browser_take_screenshot and browser_snapshot tools capture the visual and structural state of the loaded page, which may include Personal Identifiable Information (PII) or internal data if the agent navigates to authenticated or sensitive URLs.

eyes