The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions create an attack surface for indirect prompt injection by having the agent ingest and process untrusted data from the web.
Ingestion points: Web content via take_snapshot, console messages via list_console_messages, and network traffic details via list_network_requests.
Boundary markers: The skill lacks instructions for the agent to use delimiters or to treat external web data as untrusted content.
Capability inventory: The agent has access to high-impact capabilities including evaluate_script (arbitrary JavaScript execution in the browser context), fill (form interaction), and upload_file (file system interaction).
Sanitization: No methods for sanitizing, filtering, or validating the untrusted content from web pages are specified before the agent acts on it.

chrome-devtools