The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the shell eval command to execute the output of generated Python scripts (e.g., eval "$(python scripts/{feature-name}.py)"). This facilitates the dynamic execution of shell commands derived from generated content.
[REMOTE_CODE_EXECUTION]: The core workflow involves generating executable Python scripts based on data extracted from external, untrusted websites. During the Encapsulation Verification and Automated Testing phases, these generated scripts are automatically executed on the local system. A malicious website could potentially inject code into the generation process to achieve arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The skill performs extensive network operations to fetch content from arbitrary external websites. While this is the intended behavior for site exploration, it serves as the primary vector for ingesting untrusted data.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted HTML, JSON, and API responses from the web to create instructions for the agent.
Ingestion points: Website exploration via the browser-act tool in Phase 2.
Boundary markers: The instructions lack robust sanitization or delimiters to prevent data from being interpreted as instructions during the skill generation process.
Capability inventory: The agent is granted capabilities to write files to the local filesystem and execute shell/Python code.
Sanitization: No specific sanitization or escaping mechanisms for external data are described before it is incorporated into the generated SKILL.md or Python scripts.

browser-act-skill-forge