The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external, untrusted websites through the browser. \n * Ingestion points: Untrusted data enters the context via agent-browser snapshot, agent-browser errors, and agent-browser console commands (SKILL.md). \n * Boundary markers: The skill explicitly instructs the agent not to read the target app's source code ("Never read the target app's source code"), which mitigates direct injection from HTML/JS, but lacks delimiters for other browser outputs. \n * Capability inventory: The skill uses Bash to execute file system operations (mkdir, cp) and interact with the agent-browser tool. \n * Sanitization: There are no instructions for sanitizing or escaping the content retrieved from the web before the agent processes it.\n- [COMMAND_EXECUTION]: The skill logic involves interpolating user-provided variables, such as {TARGET_URL} and {PASSWORD}, directly into shell commands. If these variables contain shell metacharacters and are not properly sanitized or escaped by the agent, it could lead to arbitrary command execution on the host environment.

dogfood