The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interacts with external web content, which is inherently untrusted. It effectively manages this risk through multiple layers of defense:
Ingestion points: Untrusted data enters the agent context through tools like browser_snapshot, browser_dom, and browser_accessibility (interaction.md).
Boundary markers: The skill explicitly instructs agents to use a "Dispatch Agent" (subagent) to process large artifacts, with a prompt that requires a "concise text summary" and forbids returning "raw HTML, JSON, or image data" to the main context (SKILL.md).
Capability inventory: The skill possesses significant capabilities, including browser_evaluate for JS execution, browser_connect for launching binaries, and browser_storage for session access.
Sanitization: The browser_navigate tool implements a whitelist for http/https protocols and explicitly blocks file:// and javascript: schemes to prevent local file access or direct XSS-based injection (interaction.md).
[COMMAND_EXECUTION]: The browser_connect tool includes an executable_path parameter, allowing the agent to specify the Chrome binary used for automation. This is a standard requirement for Puppeteer-based tools.
[REMOTE_CODE_EXECUTION]: The browser_evaluate tool provides a legitimate interface for executing arbitrary JavaScript within the page context of the controlled browser instance.
[DATA_EXFILTRATION]: The skill provides tools for capturing sensitive data, such as browser_storage_state_save (cookies and session data) and browser_export_har (network traffic). The skill design enforces writing these large, sensitive artifacts to local temporary storage rather than returning them as raw bytes in the conversation context.

browser