The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process arbitrary content from the internet, which is a primary surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent context through the fetchUrlFromContext function in lib/fetch.js and search results in lib/search.js.
Boundary markers: The skill does not implement explicit delimiters or 'ignore embedded instructions' markers in the Markdown output returned to the agent.
Capability inventory: The skill has the ability to spawn browser processes (lib/cdp.js), write to local cache files (lib/search-cache.js), and execute system commands for process management.
Sanitization: Web content is sanitized via defuddle and jsdom (lib/extract.js) to convert HTML into Markdown, which reduces but does not eliminate the risk of malicious instructions being parsed by the LLM.
[COMMAND_EXECUTION]: The skill manages local browser processes using system-level commands.
Evidence: In lib/cdp.js and web-search.js, the skill uses child_process.spawn to launch Chromium-family browsers and taskkill (on Windows) to terminate them. These operations are restricted to binaries found in standard installation paths or specified via configuration.
[DYNAMIC_EXECUTION]: The skill utilizes JSDOM for parsing HTML content, which involves simulated browser behavior.
Evidence: lib/extract.js uses jsdom to parse fetched HTML. While script execution is generally discouraged in the configuration, the parsing process itself involves a complex runtime environment that processes untrusted external input.

web-search