The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from web pages, which could contain malicious instructions designed to hijack the agent's behavior.
Ingestion points: The agent reads page content and metadata using browser state, browser find, browser get text, and browser network (SKILL.md).
Boundary markers: The skill does not define specific delimiters to isolate untrusted web text from agent instructions.
Capability inventory: The skill provides access to browser controls including click, type, upload, and eval (SKILL.md).
Sanitization: There is no mention of sanitizing or filtering content retrieved from the browser.
[DATA_EXFILTRATION]: The browser upload command allows the agent to select and upload local files to the browser. An attacker-controlled website could potentially trick the agent into uploading sensitive files like credentials or private keys.
[COMMAND_EXECUTION]: The agent interacts with the opencli command-line utility via Bash(opencli:*) to perform browser automation tasks.
[DYNAMIC_EXECUTION]: The browser eval subcommand allows the agent to execute JavaScript within the browser context, representing a dynamic execution path influenced by the content of the loaded page.

opencli-browser