The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to ingest and process content from external, untrusted websites.
Ingestion points: The skill navigates to URLs provided by the user or discovered via crawling (SKILL.md).
Boundary markers: There are no explicit instructions to the agent to ignore or delimit instructions found within the captured web content.
Capability inventory: The skill utilizes page.screenshot to capture external data and includes logic to write and read files from the local filesystem.
Sanitization: The skill does not implement sanitization or filtering of the content retrieved from external pages.
[DATA_EXFILTRATION]: The skill contains logic to read files from the local filesystem to encode them into Base64 for the final HTML gallery. While intended for its own generated snapshots, this pattern of reading local data for inclusion in output is a potential exfiltration vector if misdirected.
Evidence: The to_data_uri function in SKILL.md explicitly opens and reads files from paths like snapshots/<date>/<page-slug>.png using open(png_path, 'rb').

visual-snapshot