The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to ingest data from arbitrary websites, creating a vector for malicious instructions to be processed.
Ingestion points: Data from web pages is read via browser_snapshot, browser_dom, and browser_accessibility (SKILL.md, references/interaction.md).
Boundary markers: Instructions suggest using a subagent for summarization to isolate large artifacts, but explicit delimiters or sanitization steps are not provided for the agent context (SKILL.md).
Capability inventory: The skill provides extensive interaction capabilities, including browser_type, browser_fill_form, and JavaScript execution via browser_evaluate (references/interaction.md, references/storage-capture.md).
Sanitization: No explicit instructions for sanitizing or escaping external content are present.
[DYNAMIC_EXECUTION]: The browser_evaluate tool (references/interaction.md) permits the execution of arbitrary JavaScript code within the browser's page context, which is a form of runtime code execution that could be influenced by page state.
[EXTERNAL_DOWNLOADS]: The browser_download tool (references/storage-capture.md) enables the agent to trigger and manage file downloads from remote servers to the local environment.
[COMMAND_EXECUTION]: The browser_connect tool (references/interaction.md) facilitates launching browser processes or connecting to external Chrome instances via WebSocket endpoints, involving system-level process management and network connectivity.

browser