The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes a significant surface for indirect prompt injection by design.
Ingestion points: Tools like take_snapshot, list_console_messages, and list_network_requests (defined in SKILL.md) ingest content directly from external, potentially malicious websites into the agent's context.
Boundary markers: The skill does not define structural delimiters for tool outputs, although it includes a markdown-based 'Security Warning' section instructing the agent to treat external content as untrusted.
Capability inventory: The skill provides powerful capabilities including evaluate_script (JS execution), click, fill, and upload_file (interaction).
Sanitization: There is no automated sanitization; the documentation relies on the agent to manually sanitize reported content.
[DYNAMIC_EXECUTION]: The tool evaluate_script allows the agent to run arbitrary JavaScript code within the context of the loaded web page. This functionality is inherently risky if the agent uses data from the page to construct or influence the script being executed.
[COMMAND_EXECUTION]: The interaction tools (click, fill, press_key) allow the agent to perform actions on web applications. If an agent is successfully injected via malicious page content, these tools could be used to perform unauthorized actions on the user's behalf within the browser session.

chrome-devtools