The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted content from the public web and PDF documents, creating a high surface area for indirect prompt injection. An attacker could host malicious content that, when searched or extracted, attempts to override the agent's instructions.
Ingestion points: search, search_parallel, extract, and search_extract tools in SKILL.md.
Boundary markers: None mentioned or enforced in the skill definition.
Capability inventory: Web search and extraction of HTML/PDF content into the agent's context.
Sanitization: Uses Readability for HTML and unpdf for PDFs, which may clean the format but does not sanitize malicious natural language instructions.
[EXTERNAL_DOWNLOADS]: The installation instructions require running npx google-surf-mcp or cloning https://github.com/HarimxChoi/google-surf-mcp. This repository and package are hosted by a third-party account not included in the trusted vendor list for this author context.
[DATA_EXFILTRATION]: The configuration variable SURF_ALLOW_PRIVATE=true enables the browser to access private IP addresses. This creates a Server-Side Request Forgery (SSRF) risk, where a malicious prompt or website could trick the agent into probing or extracting data from internal network services.
[PRIVILEGE_ESCALATION]: The environment variable SURF_NO_SANDBOX=true allows the agent to run the browser without its security sandbox. This significantly increases the risk that a browser-level exploit triggered by a malicious website could escape to the host system.

google-surf-mcp-search