The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from the internet via the extract and interact commands. Malicious instructions embedded in a website's HTML or text could influence the agent's behavior once processed.
Ingestion points: Web content retrieved via extract and DOM data retrieved via --eval in SKILL.md.
Boundary markers: None identified; untrusted content is processed directly.
Capability inventory: File writing (screenshots, PDFs), command execution (bin scripts), and JavaScript execution in the browser.
Sanitization: No evidence of input sanitization or output filtering.
[DATA_EXFILTRATION]: The skill promotes the use of the --user-data flag to store persistent Chrome profiles in directories like ~/.chrome-instacart. These profiles contain sensitive session information, including authentication cookies and saved credentials. If the agent is manipulated by a malicious site, it could be instructed to extract and transmit data from these active sessions.
[COMMAND_EXECUTION]: The skill makes extensive use of an --eval flag to execute arbitrary JavaScript within the browser context. This dynamic code execution capability is a significant risk, as it allows the agent to interact with the DOM, access cookies, and perform network requests from the user's browser, potentially bypassing traditional security boundaries if the agent receives malicious instructions.

browser-automation