The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes an upgrade command in references/operations.md that is described as downloading a release, stopping the running daemon, and replacing the binary at ~/.kimi-webbridge/bin/kimi-webbridge. This self-updating mechanism allows for the execution of remote code from unverifiable sources.\n- [DYNAMIC_EXECUTION]: The evaluate tool allows the execution of arbitrary JavaScript code within the browser context. The cdp tool provides raw access to the Chrome DevTools Protocol, enabling low-level manipulation of the browser environment.\n- [PRIVILEGE_ESCALATION]: The screenshot and save_as_pdf tools in SKILL.md accept a path argument. The documentation states that parent directories are created and existing files are overwritten verbatim. This capability allows the agent to write to or overwrite any file the user has permission to access, which could be used for data destruction or system modification.\n- [DATA_EXFILTRATION]: The network tool is capable of capturing full HTTP request and response data, including requestHeaders (which often contain session cookies, tokens, or authorization headers) and body content. This presents a high risk of sensitive data exposure if the agent is directed to interact with authenticated sites.\n- [COMMAND_EXECUTION]: The skill instructions require the agent to execute the kimi-webbridge daemon binary via the shell (e.g., ~/.kimi-webbridge/bin/kimi-webbridge start).\n- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting untrusted data from external websites, which serves as a vector for indirect prompt injection.\n
Ingestion points: Data enters the agent's context through tools like snapshot (accessibility tree), read_page (iframe content), and network (captured HTTP traffic).\n
Boundary markers: The skill instructions do not provide specific boundary markers or warnings to the model to ignore instructions embedded in the external content.\n
Capability inventory: The skill provides significant capabilities to an attacker who successfully injects instructions, including click, fill, evaluate, cdp, and file-system write operations via screenshot and save_as_pdf.\n
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from external sources before it is processed by the agent.

kimi-webbridge