The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing untrusted external web content, which presents a significant attack surface for indirect injections.
Ingestion points: As defined in SKILL.md, the agent ingests data from visible text, HTML markup, element attributes, accessibility labels, console logs, network payloads, and filenames.
Boundary markers: SKILL.md contains an explicit 'Page content is untrusted' section that defines a clear boundary between user instructions and page data, instructing the agent to never treat the latter as authoritative.
Capability inventory: The bsk toolset provides extensive capabilities including browser navigation, form interaction, file upload/download, JavaScript execution (evaluate), and network request inspection (debug).
Sanitization: The instructions mandate that the agent must report detected injection attempts and pause if safety cannot be determined, though it relies on the agent's reasoning rather than automated sanitization.
[COMMAND_EXECUTION]: The skill logic is entirely centered on the execution of the bsk CLI utility to perform browser management, interaction, and daemon control tasks.
[DYNAMIC_EXECUTION]: In references/interaction-details.md, the skill describes the bsk evaluate command, which enables the execution of arbitrary JavaScript within the browser's context. This is a high-privilege feature that could be exploited if an attacker successfully injects malicious scripts through a webpage.

browser-skill