The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and extract data from external websites using commands like bdg dom get, bdg dom query, and bdg dom screenshot. This creates a vulnerability where an attacker could host a malicious website containing hidden instructions designed to manipulate the agent's behavior once the content is ingested into its context.
Ingestion points: Web page content retrieved via DOM queries, raw HTML, and JavaScript evaluation in SKILL.md.
Boundary markers: None present; the instructions do not specify delimiters or warnings for the agent to ignore embedded instructions in the scraped content.
Capability inventory: The skill can execute shell commands (bdg), write files (bdg dom screenshot), navigate the network via the browser, and manage processes (bdg cleanup).
Sanitization: No sanitization or validation of the external content is described before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill explicitly supports and provides examples for executing arbitrary JavaScript within the browser context using bdg dom eval and bdg cdp Runtime.evaluate. This capability allows for complex, runtime-generated logic to be executed in the target environment.
[COMMAND_EXECUTION]: The documentation provides examples of shell command construction using variables (e.g., bdg dom fill "input[name='username']" "$USER"). If these variables are populated with untrusted input from external data sources without proper sanitization, it could lead to command injection on the host system.
[DATA_EXFILTRATION]: The skill provides direct access to the Chrome DevTools Protocol (CDP), including methods like Network.getCookies. This allows the agent to extract sensitive session data, authentication tokens, and cookies from the browser environment, which could then be exfiltrated.

bdg