The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from the 'Grok Bot' application's interface, specifically message transcripts and sidebar previews.
Ingestion points: The skill uses agent-browser eval in SKILL.md to extract text from DOM elements ([role=group][aria-label$="message"] and [aria-label="Bot list"]).
Boundary markers: There are no explicit boundary markers or instructions to the agent to treat the extracted text as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has access to shell commands via Bash (pkill, open, lsof, pgrep) and the ability to interact with the application's DOM via agent-browser (click, eval).
Sanitization: Extracted text is subjected to basic whitespace collapsing and character slicing (.slice(0,200)), but no semantic sanitization is applied to prevent instruction injection.
[COMMAND_EXECUTION]: The skill instructs the agent to perform process management tasks to enable remote debugging. This includes using pgrep to check for the process, pkill to terminate it, and open -a with specific arguments (--remote-debugging-port=9231) to restart it with an open debugging port.
[DATA_EXPOSURE]: The skill extracts private user information, including a roster of bots, their UUIDs, activity timestamps, and message history, into the agent's context for processing.

using-grok-bot-app