The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install several third-party packages and binaries.
Evidence: Commands such as pip install playwright playwright-stealth and playwright install chromium are documented for setup.
Evidence: Node.js packages playwright-extra, playwright-extra-plugin-stealth, and @extra/recaptcha are recommended for Cloudflare bypass functionality.
[DATA_EXFILTRATION]: Automated scans detected a malicious URL within the skill's documentation and code examples.
Evidence: The URL https://another-site.com is included in the urls list within the Batch Screenshots example in SKILL.md. This URL has been flagged as blacklisted by security scanners.
Evidence: The skill lacks any URL filtering or allow-listing, which allows the browser engine to navigate to internal network resources or sensitive local file paths (e.g., file:///etc/passwd) via the screenshotting tool (SSRF risk).
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its handling of untrusted external content.
Ingestion points: The url parameter in get_screenshot, get_screenshot_custom_path, capture_multiple_screenshots, and other variants in SKILL.md allows the agent to ingest arbitrary web content.
Boundary markers: None. There are no instructions to the agent to ignore or delimit instructions found within the rendered content of the pages it screenshots.
Capability inventory: The skill has access to Bash, Read, and Write tools (specified in frontmatter), and the ability to execute a full browser environment via Playwright.
Sanitization: None. There is no validation or sanitization of the input URL or the resulting screenshot data before it is processed or returned to the agent context.

webpage-screenshotter