The Agent Skills Directory

[DYNAMIC_EXECUTION]: The execute tool facilitates the execution of arbitrary JavaScript code through the code parameter. This provides a mechanism for the agent to run complex, multi-step scripts within the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to ingest and act upon data from external websites. There is a risk that a malicious site could embed instructions targeting the agent's broad capabilities, such as using the execute tool to exfiltrate environment variables or session data.
Ingestion points: External URLs accessed via the navigate and web_vitals tools in SKILL.md.
Boundary markers: No specific delimiters or warnings for embedded instructions are defined in the skill instructions.
Capability inventory: Includes arbitrary code execution (execute), file system writes (screenshot with path), and source code logic injection (set_tracepoint, set_logpoint) across the extension tools.
Sanitization: No evidence of sanitization or filtering for untrusted web content before processing or interpolation.
[COMMAND_EXECUTION]: The screenshot tool accepts an optional path parameter. This allows the agent to write files to the local file system, which could be exploited to write to sensitive or unauthorized directories if the path is not strictly validated.
[DYNAMIC_EXECUTION]: Tools such as set_tracepoint and set_logpoint allow for the injection of conditions and log messages into specified source files. This capability enables runtime modification of application logic during debugging sessions.
[EXTERNAL_DOWNLOADS]: The extension configuration includes mechanisms for downloading Playwright browser binaries and installing the extension from the Open VSX registry.

browser-devtools-mcp-vscode