The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted content from web pages to decide its next actions.
Ingestion points: The capturePageState method in references/examples.md extracts page HTML and takes screenshots of external sites.
Boundary markers: Absent. The prompt construction in buildReasoningPrompt lacks clear delimiters or explicit instructions to help the model ignore malicious commands embedded in the webpage content.
Capability inventory: The agent can perform high-impact actions like click, type (form filling), navigate, and extract (data harvesting), as seen in executeAction in references/examples.md.
Sanitization: Absent. Raw HTML and visual data are passed directly to the vision model without sanitization or filtering.
[COMMAND_EXECUTION]: The agent executes browser-level interactions (clicking, typing, navigating) based on reasoning derived from untrusted external web content. This allows a malicious website to potentially manipulate the agent into performing unintended actions on other sites or with local session data.
[EXTERNAL_DOWNLOADS]: The implementation example in references/examples.md imports the playwright library to facilitate browser automation.

webvoyager