The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on remote web content, creating a surface for indirect prompt injection attacks where malicious instructions could be embedded in scraped pages.
Ingestion points: Remote page content, search result titles, and URLs fetched via HTTP, browsers, or crawlers (documented in FETCHING.md, WEB-SEARCH.md, and CRAWLING.md).
Boundary markers: The skill explicitly mandates treating all fetched content as untrusted and recommends narrowing data with CSS selectors and sanitization before it reaches the model (SKILL.md, UNTRUSTED-CONTENT.md).
Capability inventory: Provides tools for making network requests, browser navigation, interactive actions (typing, clicking), and JavaScript evaluation within the browser context (MCP-SERVER.md).
Sanitization: Detailed procedures are provided for removing hidden elements (CSS-hidden, aria-hidden), scripts, styles, HTML comments, and zero-width characters (UNTRUSTED-CONTENT.md).
[DYNAMIC_EXECUTION]: The MCP server implementation includes a browser_evaluate tool that allows for JavaScript execution within a controlled browser session to handle dynamic web content.
[COMMAND_EXECUTION]: The skill references standard CLI operations for scraping, such as scrapling extract and the execution of Node.js helper scripts (e.g., extract_page.mjs) for content extraction.
[SAFE]: Strong SSRF (Server-Side Request Forgery) protections are integrated, including a "safe" redirect mode that automatically rejects internal, private, and cloud metadata IP addresses.
[SAFE]: The skill promotes secure credential handling by advising the use of environment variables for API keys and session tokens, and warns against exposing browser storage states.

web-scraping