The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate to and extract content from arbitrary websites, which is then processed by the AI agent, creating a vulnerability surface.
Ingestion points: Untrusted data enters the agent's context through calls to page.goto() followed by content extraction via page.content(), page.title(), page.text_content(), and page.$$eval() as shown in SKILL.md (Quick Start) and examples.md (Basic usage, Data extraction, etc.).
Boundary markers: The skill instructions and code examples do not include delimiters or specific instructions for the agent to ignore or isolate commands potentially embedded within the scraped web content.
Capability inventory: The skill provides full web automation capabilities including arbitrary navigation, form filling (page.fill), clicking (page.click), and data extraction across all scripts in SKILL.md and examples.md.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the ingested web content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The code examples utilize the capability to execute JavaScript within the remote browser context (e.g., page.$$eval and page.evaluate in examples.md), which is a standard feature of the Playwright and Puppeteer libraries for data extraction and DOM manipulation.

headless-browser