The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external web pages, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill uses content get-as-html and content get-as-text to retrieve web page content (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore potentially malicious directions embedded within the fetched HTML or text.
Capability inventory: The skill possesses significant interaction capabilities, including navigating to URLs, filling forms, clicking elements, and capturing screenshots (SKILL.md).
Sanitization: No evidence of sanitization or filtering is provided for the data retrieved from external web sources before it is analyzed by the agent.
[DYNAMIC_EXECUTION]: The skill documentation promotes the use of dynamic code execution for optimizing multi-step flows.
Evidence: In the "Best Practices" section of SKILL.md, the skill suggests using browser-devtools-cli execute --code "..." with callTool() to batch operations. This involves the agent generating and executing script-like code at runtime, which is a common vector for manipulation if the logic is influenced by untrusted external data.

browser-testing