The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The screenshot and save_as_pdf tools accept an optional path parameter. The documentation states that the provided path is written to verbatim, including creating parent directories and overwriting existing files. This allows for arbitrary file writes and potential system file corruption or configuration modification.
[COMMAND_EXECUTION]: The references/operations.md file instructs the agent to execute a local binary (~/.kimi-webbridge/bin/kimi-webbridge start on macOS/Linux or the equivalent .exe on Windows) to start the daemon if it is not reachable. This is a direct command execution capability.
[DATA_EXFILTRATION]: The network tool allows the agent to inspect request and response data, which typically contains sensitive authentication tokens, cookies, and PII from the user's active browser sessions. Additionally, the cdp tool provides raw Chrome DevTools Protocol access, allowing for deep inspection and manipulation of the browser environment.
[DYNAMIC_EXECUTION]: The evaluate tool enables the execution of arbitrary JavaScript code within the context of the loaded web page. While intended for automation, this provides a runtime execution surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to scrape and interact with arbitrary web content via snapshot and evaluate. Because the agent has powerful capabilities (file write, binary execution), it is vulnerable to malicious instructions embedded in websites (indirect prompt injection).
Ingestion points: The snapshot tool reads the page's accessibility tree, the evaluate tool returns arbitrary JS execution results, and the network tool intercepts page traffic.
Boundary markers: None identified. There are no instructions for the agent to delimit or treat the ingested web content as untrusted data.
Capability inventory: The skill includes arbitrary file write (screenshot, save_as_pdf), local binary execution (kimi-webbridge start), and access to authenticated browser sessions.
Sanitization: No sanitization, validation, or filtering of the ingested web content is performed before the agent processes or acts upon it.

kimi-webbridge