The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from the open web, creating a potential surface for indirect prompt injection attacks where malicious content on a webpage could attempt to influence agent behavior.
Ingestion points: Web content retrieved via browser_get_text and browser_get_html tools as described in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or guidelines for the agent to separate fetched content from its internal instructions.
Capability inventory: The skill includes active interaction tools (browser_click, browser_fill) and navigation tools (browser_navigate) which could be targeted by injected instructions.
Sanitization: No explicit content sanitization or filtering logic is defined within the skill instructions.
[DATA_EXFILTRATION]: The browser is configured to allow access to localhost. While a standard browser feature, this provides a pathway for the agent to interact with local services, which could lead to unintended data exposure if the agent is successfully manipulated by external content or malicious prompts.

cua