The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from arbitrary external web pages, which presents a surface for indirect prompt injection if the page content contains adversarial instructions.
Ingestion points: The tabstops.js script (invoked by SKILL.md) reads textContent, aria-label, aria-labelledby, alt, title, and placeholder attributes from all elements within the target web page's DOM.
Boundary markers: The skill output is requested as a structured numbered list, but the raw text content extracted from the DOM is not enclosed in specific delimiters or preceded by safety warnings to the agent.
Capability inventory: The skill's capabilities are limited to browser DOM inspection and simulated keyboard input (via Playwright or OS keys). It does not have access to the host file system or network.
Sanitization: The nameOf function in tabstops.js performs basic whitespace normalization and trimming on extracted text, but it does not filter for potentially malicious natural language instructions.
[DYNAMIC_EXECUTION]: The skill utilizes a bundled JavaScript file to perform its core analysis within a browser context.
Execution pattern: The instructions in SKILL.md direct the agent to run tabstops.js via the browser's evaluation mechanism (e.g., page.evaluate or DevTools console).
Source integrity: The script is a static, transparently written component of the skill itself, not dynamically generated or fetched from a remote source at runtime.

keyboard