The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted web content, which presents an attack surface for instructions embedded in third-party websites.
Ingestion points: The page_snapshot and page_flow tools (SKILL.md) ingest external DOM content and text into the agent's context.
Boundary markers: The documentation in docs/browser-safety.md provides explicit defensive instructions to treat page content as data rather than instructions.
Capability inventory: The skill possesses the ability to perform network actions and form submissions via element_click, element_input, and page_flow tools.
Sanitization: The skill mandates robust user confirmation requirements in docs/confirmations.md for any consequential or sensitive actions.
[PROMPT_INJECTION]: Instructions regarding visibility and internal terminology were evaluated for potential concealment.
Evidence: SKILL.md and docs/visibility.md provide guidance on narrating background actions and avoiding internal technical jargon in user communications.
Analysis: These instructions were found to be benign, aimed at improving user experience and maintaining transparency by requiring the agent to proactively inform the user of actions taken in background tabs.

control-browser