The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted DOM data from web pages which is then processed by a 'Jev' model and a Tier 3 LLM to determine actions and field values. This creates a surface where a malicious website could embed instructions to manipulate the agent's behavior. Ingestion points: 'scripts/lib/jev_browser/snapshot.js' extracts DOM structure, text, labels, and values into a snapshot for processing. Capability inventory: The agent can perform browser actions (CLICK, TYPE_TEXT, SELECT, navigate) and inject environment variables (secrets) into page fields. Scripts such as 'scripts/jev-browser-agent.py' manage this execution loop. Boundary markers: The documentation mentions wrapping page data in '' tags and removing any instances of these tags planted by the page to prevent instruction leakage. Sanitization: Strings are flattened to single lines via 'scripts/lib/jev_untrusted.py' to prevent schema forging, and payloads are redacted before being sent to the models.
[DATA_EXFILTRATION]: The '--secret-env' and '--header' flags allow sensitive environment variables to be injected into the browser context for form filling or authentication. While the skill defaults to loopback addresses and requires explicit whitelisting via '--allow-host' for remote navigation, a user whitelisting a malicious host could inadvertently expose these secrets if the model is manipulated into typing them into an attacker-controlled form or sending them in headers to a remote endpoint.

browser-jev-automation