The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill navigates to and interacts with live web applications, ingesting untrusted data via accessibility snapshots and element annotations. This creates a surface for indirect prompt injection where malicious content on a web page could attempt to override the agent's instructions. Ingestion points: The snapshot and annotate commands in scripts/browser-driver.mjs capture the text structure and visual state of external web pages. Boundary markers: The skill instructions do not provide delimiters or specific warnings to the agent to ignore or isolate instructions encountered within the tested application's UI. Capability inventory: The agent has broad capabilities via the Bash tool to perform file operations and network requests across the scripts, which could be abused if an injection is successful. Sanitization: The skill does not sanitize or filter the content retrieved from the web pages before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill downloads necessary dependencies and browser binaries during its setup phase. Evidence: The SKILL.md file instructs the agent to run npm install and npx playwright install chromium in the scripts directory. Context: These resources are official packages for the Playwright testing framework and are maintained by a well-known, trusted organization (Microsoft).

dogfood