The Agent Skills Directory

[COMMAND_EXECUTION]: The agent is instructed to run the node scripts/perf.mjs command to collect performance metrics.\n- [DYNAMIC_EXECUTION]: The perf.mjs script uses page.evaluate() to execute JavaScript code dynamically. This includes code passed as a string via the --ready command-line argument and the contents of a local file specified by the --setup argument.\n- [EXTERNAL_DOWNLOADS]: The skill requires the puppeteer package, which downloads a Chromium browser binary from external servers during installation.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external URLs via a headless browser. This creates an attack surface for indirect prompt injection where a malicious website could attempt to influence the agent's output or actions.\n
Ingestion points: The --url parameter in scripts/perf.mjs determines which external content is loaded into the agent's instrumentation environment.\n
Boundary markers: There are no explicit boundary markers or sanitization steps to distinguish between legitimate game content and potential injection attempts in the analyzed page.\n
Capability inventory: The skill possesses capabilities for shell execution, local file reading, network access via a browser, and dynamic JavaScript evaluation.\n
Sanitization: The script performs minimal validation on the strings and file contents passed to the dynamic evaluation functions.\n- [PRIVILEGE_ESCALATION]: Documentation within scripts/perf.mjs suggests disabling the Chrome sandbox (--no-sandbox) in Linux containers or specific security environments. Disabling this isolation feature significantly increases the risk to the host system if malicious content is processed by the browser.

web-game-performance