The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external websites, creating a surface for indirect prompt injection attacks where malicious instructions on a webpage could override agent behavior.
Ingestion points: Untrusted data enters the agent's context through browser_snapshot (ARIA tree extraction) and browser_get_console_logs (SKILL.md).
Boundary markers: The skill documentation does not provide instructions for using delimiters or boundary markers to separate ingested content from system instructions.
Capability inventory: The skill possesses powerful capabilities to interact with the browser environment based on model output, including browser_navigate, browser_click, browser_type, browser_press_key, and browser_screenshot (SKILL.md).
Sanitization: There is no indication of sanitization, filtering, or validation of the web content before it is presented to the model.
[EXTERNAL_DOWNLOADS]: The installation process requires downloading source code from a third-party GitHub repository that is not part of the trusted vendor list.
Evidence: Installation instructions in SKILL.md direct users to execute git clone https://github.com/BrowserMCP/mcp.git followed by npm install and npm run build.

browser-mcp-control