The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user to install the required daemon by piping a remote script directly into the shell (curl -fsSL https://kimi-web-img.moonshot.cn/webbridge/install.sh | bash). This is a high-risk pattern that allows for arbitrary code execution during setup.
[REMOTE_CODE_EXECUTION]: The evaluate tool allows the agent to execute arbitrary JavaScript code within the context of the user's browser sessions. This powerful capability could be abused to perform unauthorized actions or bypass security controls on websites the user is logged into.
[EXTERNAL_DOWNLOADS]: The skill downloads an installation script from an external domain (kimi-web-img.moonshot.cn) that is not recognized as a trusted source in this environment.
[COMMAND_EXECUTION]: The skill frequently uses shell commands for lifecycle management (start, stop, status, logs) and provides a dedicated shell script (scripts/screenshot.sh) to process image data using curl, jq, and base64.
[DATA_EXFILTRATION]: By gaining control over the user's real browser sessions, the skill has access to sensitive data (cookies, active logins, private pages). It can capture this data via the snapshot, screenshot, and save_as_pdf tools, creating a significant risk of data exposure.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection attacks.
Ingestion points: Untrusted web content enters the agent's context through the snapshot tool (accessibility tree) and the network tool (raw network traffic).
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between legitimate web content and potential malicious instructions embedded in pages.
Capability inventory: The agent has the ability to execute shell commands (curl), write files to the local disk (/tmp), and execute arbitrary JavaScript (evaluate).
Sanitization: No sanitization or filtering of the ingested web content is performed before it is processed by the agent.

kimi-webbridge