The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external, untrusted websites using tools like mcp__playwright__browser_snapshot and mcp__playwright__browser_evaluate.
Ingestion points: External data enters the agent context through accessibility snapshots and DOM inspection results in the ScreenshotToCodeWorkflow and TokenExtractionWorkflow examples in SKILL.md.
Boundary markers: The prompt templates used to analyze this data (e.g., in analyze_screenshot) do not utilize clear delimiters or instructions to ignore embedded instructions within the captured snapshots.
Capability inventory: The skill instructions enable powerful capabilities including navigation (browser_navigate), page interaction (browser_click, browser_type), and file system writes (browser_take_screenshot with filename parameters).
Sanitization: There is no evidence of sanitization, filtering, or validation of the external content before it is interpolated into LLM prompts.
[DYNAMIC_EXECUTION]: The skill utilizes mcp__playwright__browser_evaluate to execute JavaScript strings within a browser environment. The provided patterns demonstrate assembling these scripts as strings at runtime (e.g., cdp_evaluate and the style extraction functions), which constitutes a dynamic execution surface within the browser context.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute operations in a browser environment, including navigating to arbitrary URLs and performing interactions. If the agent were to encounter malicious instructions via an indirect prompt injection, these tools could be misused to perform unauthorized navigation or interactions on behalf of the user.

browser-devtools-mcp