The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate to and extract data from external, untrusted websites, creating a surface for indirect prompt injection.
Ingestion points: browser action=navigate, action=get_text, and action=screenshot in SKILL.md allow external content to enter the agent's context.
Boundary markers: The instructions lack delimiters or specific directives to ignore instructions embedded in the processed web content.
Capability inventory: The skill can execute JavaScript (evaluate), save cookies/state to the local filesystem (save_state), and perform network operations via the browser.
Sanitization: There is no logic provided to sanitize or validate the content retrieved from external URLs.
[DYNAMIC_EXECUTION]: The action=evaluate parameter allows the agent to execute arbitrary JavaScript code within the context of the current web page. This provides a mechanism for running dynamic code that could be used to interact with sensitive site features or manipulate the browser session.

browser