The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external web sources. This occurs when the agent navigates to or scrapes a website containing hidden instructions designed to manipulate its subsequent actions.
Ingestion points: Data enters the agent's context through the open, scrape, and snapshot commands, which fetch content from arbitrary URLs.
Boundary markers: The skill instructions do not specify the use of delimiters or provide 'ignore embedded instructions' warnings for the agent when handling scraped data.
Capability inventory: The skill allows for significant browser interaction (clicks, form fills), remote JavaScript execution via the eval command, and local file writing using the --output flag.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external sites before it is presented to the agent.

firecrawl-browser