The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the structured question configuration it processes.
Ingestion points: The agent is instructed to populate a CONFIG object in SKILL.md with question titles, details, and IDs, which may originate from untrusted external data.
Boundary markers: No specific boundary markers or instructions are provided to sanitize external content before interpolation.
Capability inventory: The skill uses browser_evaluate to inject JavaScript and browser_take_screenshot to display the UI to the user.
Sanitization: The qa-form.js engine uses a custom esc() function that escapes several HTML characters but fails to escape single quotes ('). These quotes are used to delimit data in onclick event handlers, enabling an attacker to break out of the string and execute arbitrary JavaScript in the Playwright browser.
[COMMAND_EXECUTION]: The skill reads the content of a local file, qa-form.js, and executes it dynamically within a browser session using the browser_evaluate tool.

visual-qna