The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The references/detailed-guide.md file instructs users to run code directly from a remote GitHub repository using go run github.com/nichochar/go-rod.github.io/cmd/launcher@latest. This facilitates the execution of unverified code from an external source at runtime.
[DATA_EXFILTRATION]: The examples/request_hijacking.go script demonstrates how to use the HijackRequests API to intercept and modify network traffic. It includes code to set Authorization headers and inject scripts into JavaScript responses, which are common primitives for credential harvesting and session hijacking.
[DYNAMIC_EXECUTION]: Multiple examples (e.g., examples/basic_scrape.go, examples/stealth_page.go) use MustEval and MustEvalOnNewDocument to execute arbitrary JavaScript within the browser context. This allows for runtime code execution that can be controlled or influenced by the content of the websites being automated.
[INDIRECT_PROMPT_INJECTION]: The skill automates the processing of untrusted data from the web, creating a vulnerability to indirect prompt injection.
Ingestion points: The skill retrieves text, titles, and response bodies from external URLs in examples/basic_scrape.go and examples/request_hijacking.go.
Boundary markers: There are no markers or instructions to isolate untrusted data from the agent's logic.
Capability inventory: The skill includes tools for file system writes (MustScreenshot, utils.OutputFile), network manipulation (HijackRequests), and code execution (MustEval).
Sanitization: No filtering or sanitization is performed on the data ingested from the browser.
[COMMAND_EXECUTION]: The skill uses the launcher library to spawn browser processes with arbitrary command-line flags (e.g., launcher.New().Headless(true).MustLaunch() in examples/stealth_page.go), allowing the agent to execute and control local processes.

go-rod-master