The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze content from external websites, which presents an attack surface for indirect prompt injection if a site contains malicious instructions targeting the agent.
Ingestion points: scripts/observe-runtime.mjs (via Playwright page.goto and page.content()) and scripts/lib/pages.mjs (via fetch).
Boundary markers: SKILL.md provides strict instructions to label claims (e.g., OBSERVED, REVIEW REQUIRED) and explicitly forbids claiming legal 'compliance'.
Capability inventory: The skill has network access and can drive a headless browser via Playwright.
Sanitization: scripts/lib/html.mjs includes logic to decode HTML entities and extract visible text, reducing the impact of certain injection techniques.
[COMMAND_EXECUTION]: The browser automation components search for local Chromium and Google Chrome executables across common system and user directories to facilitate runtime analysis.
Evidence: scripts/lib/browser.mjs checks for Playwright caches in homedir() (~/.cache/ms-playwright or ~/Library/Caches/ms-playwright) and searches standard application paths on macOS, Linux, and Windows.
[EXTERNAL_DOWNLOADS]: The skill depends on Playwright for its core functionality. While it does not download packages itself, it is designed to work with external Node.js packages and browser binaries.
Evidence: scripts/lib/browser.mjs uses dynamic imports to load playwright or playwright-core if available in the local or global environment.

consent-management