The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/setup_webctl.py executes shell commands using subprocess.run with shell=True. While the commands themselves appear to be static strings (pip install webctl, webctl setup), the use of shell execution is a high-privilege operation.
subprocess.run("pip install webctl --break-system-packages", shell=True)
subprocess.run("webctl setup", shell=True)
[EXTERNAL_DOWNLOADS]: The skill downloads and installs external software from public registries and remote sources.
Installs the webctl package via pip.
Executes webctl setup, which typically downloads Chromium or other browser binaries to the container environment.
[DYNAMIC_EXECUTION]: The skill performs self-modification of the environment by patching the source code of an installed Python library at runtime.
scripts/setup_webctl.py reads /usr/local/lib/python3.12/dist-packages/webctl/daemon/session_manager.py, performs a string replacement to inject custom proxy logic, and writes the modified content back to the system directory.
[PRIVILEGE_ESCALATION]: The setup script attempts to write files and modify code within system-wide Python package directories (/usr/local/lib/python3.12/dist-packages/), which typically requires root or elevated privileges. Additionally, auth_proxy.py starts a local server on port 18080 that injects authentication credentials from the environment into any request it receives without verifying the identity of the requesting process.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by design, as it involves browsing and scraping external web content that is then ingested into the agent's context.
Ingestion points: webctl snapshot and webctl query in SKILL.md read and return DOM elements and page content from arbitrary URLs.
Boundary markers: None identified; instructions do not explicitly tell the agent to ignore instructions embedded in the scraped HTML.
Capability inventory: The skill allows the agent to perform follow-up actions like webctl click, webctl type, and webctl navigate based on ingested data.
Sanitization: No evidence of sanitization or filtering of the scraped content before it is presented to the LLM.

using-webctl