The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites through commands like open, snapshot, console, and lighthouse. This creates a vulnerability where instructions embedded in a target webpage could attempt to manipulate the agent's logic.
Ingestion points: open, snapshot, console, network, lighthouse (SKILL.md)
Boundary markers: Absent; the skill does not specify delimiters or warnings to ignore instructions found within the processed page content.
Capability inventory: eval (JavaScript execution), upload (file reading), screenshot/network-get (file writing), and fill/click (interaction).
Sanitization: Absent; no explicit escaping or filtering of web content is described.
[DYNAMIC_EXECUTION]: The eval command allows for the execution of arbitrary JavaScript within the browser context. While standard for web automation tools, this provides a mechanism to execute code that could be influenced by external, untrusted web data.
[COMMAND_EXECUTION]: The installation instructions recommend using npx -y chrome-devtools-axi, which automatically downloads and executes the CLI wrapper. While standard for Node.js utilities, this pattern bypasses user confirmation for package execution.
[DATA_EXFILTRATION]: The skill possesses file system access capabilities, including reading local files via the upload command and writing network request/response data or screenshots to local files using network-get and screenshot. These features are intended for automation but could be abused to access or store sensitive information if the agent is misled.

chrome-devtools-axi-browser-automation