The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function is to ingest and act upon content from untrusted external sources (web pages, native apps, and CLI terminals).\n
Ingestion points: The agent reads external content using agent-browser snapshot (HTML/DOM), mcp__computer-use__screenshot (pixel-based screenshots), and tmux capture-pane (terminal output history).\n
Capability inventory: The skill has access to powerful capabilities including the Bash shell, file system Write and Edit tools, and agent-browser eval for JavaScript execution. It also performs git operations such as git commit and git revert on the local repository.\n
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat data from the target applications as untrusted or to ignore instructions found within that data.\n
Sanitization: The skill does not perform any sanitization or filtering of the captured data before it is analyzed by the agent.\n- [EXTERNAL_DOWNLOADS]: The instructions in references/browser-mode.md direct the user or agent to install an external package from a public registry if the required tool is not present in the environment.\n
Evidence: npm install -g agent-browser && agent-browser install.\n- [COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to perform sensitive operations such as git branch analysis, source code modification, and committing changes. While these are part of the intended QA and bug-fix workflow, they represent a significant capability surface if the agent's behavior is influenced by malicious data.\n- [DYNAMIC_EXECUTION]: In browser mode, the skill utilizes agent-browser eval to execute arbitrary JavaScript within the context of the web page being tested, which is used for querying page state and performance metrics.

qa