The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from SAP web interfaces and possesses high capabilities for browser and system interaction.
Ingestion points: The scripts/cdp-agent.mjs script (specifically the inspect and evaluate commands) reads DOM content and innerText from the target SAP web pages.
Boundary markers: There are no explicit boundary markers or delimiters defined in the instructions to separate untrusted web content from agent instructions.
Capability inventory: The skill can launch and stop processes (edge-profile.ps1), navigate pages, click, type, execute arbitrary JavaScript (Runtime.evaluate), and read/write local files including browser profiles and screenshots.
Sanitization: Authentication state (cookies, local storage) is serialized as JSON before injection, providing some protection against malformed data, but raw page content is not sanitized before analysis by the agent.
[COMMAND_EXECUTION]: The skill uses scripts/edge-profile.ps1 to execute shell commands for launching Microsoft Edge with specific debugging flags and managing browser processes using Start-Process and Stop-Process.
[PRIVILEGE_ESCALATION]: The skill instructs the agent to run PowerShell scripts with the -ExecutionPolicy Bypass flag, which circumvents local script execution policies designed to prevent the running of unsigned or untrusted scripts.
[DATA_EXPOSURE]: The skill accesses highly sensitive data by cloning the Microsoft Edge 'User Data' directory (%LOCALAPPDATA%\Microsoft\Edge\User Data). It extracts session cookies, local storage, and other authentication materials to facilitate 'auth-state bootstrapping' in an isolated environment.
[DYNAMIC_EXECUTION]: The scripts/cdp-agent.mjs utility uses the Runtime.evaluate CDP method to dynamically execute JavaScript expressions within the browser context at runtime. This capability is used for inspecting page state and injecting authentication markers.

sap-browser-automation