The Agent Skills Directory

[PERSISTENCE]: The installation script (scripts/setup) appends a PATH export to the user's shell configuration files (such as .zshrc, .bashrc, or .profile) to ensure its CLI tool remains permanently available.
[DYNAMIC_EXECUTION]: The SDK daemon (sdk/repl.ts) implements an HTTP server with an /eval endpoint that executes arbitrary JavaScript strings provided in the request body using the eval() function.
[EXTERNAL_DOWNLOADS]: The recording module (sdk/recording.ts) fetches the rrweb library from the jsDelivr CDN at runtime and subsequently injects it into browser tab contexts to enable session capture.
[PRIVILEGE_ESCALATION]: The framework includes logic in sdk/session.ts that uses macOS osascript to programmatically send a Return keystroke to the "Dia" browser process, effectively bypassing security dialogs requesting permission for remote debugging connections.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by ingesting untrusted data from web pages into the agent's context.
Ingestion points: Data enters the context via accessibility snapshots and DOM queries performed in sdk/page.ts and sdk/interaction.ts.
Boundary markers: Absent. Snapshots of web content are provided to the agent without delimiters or specific warnings to ignore instructions embedded in the page data.
Capability inventory: The framework provides extensive capabilities, including arbitrary code execution via the REPL daemon, network requests from the browser context, and local file access as suggested in its usage recipes.
Sanitization: The skill redacts sensitive field values (passwords, PII) by default and uses isolated execution environments for its injected scripts.

cdp