The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to interact with, reason over, and extract data from external websites. This exposes the agent to indirect prompt injection, where malicious instructions embedded in a website's HTML or text could attempt to subvert the agent's goals.
Ingestion points: Content from any URL provided to skyvern browser navigate, extract, or run-task as described in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or "ignore" rules to help the agent distinguish between its system instructions and data retrieved from the web.
Capability inventory: The skill provides access to a powerful browser automation tool capable of form submission, navigation, and credential retrieval.
Sanitization: There are no explicit instructions for validating or sanitizing the content retrieved from websites before the agent processes it.
[COMMAND_EXECUTION]: The skill relies on the execution of various CLI commands (e.g., skyvern browser session, skyvern workflow run). While these are the intended method of operation, they represent a high degree of local system interaction controlled by the agent's reasoning.

skyvern-browser-automation