The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs one-time setup by installing the playwright and axe-core Node.js packages from the npm registry. It also downloads the Chromium browser binary using the Playwright CLI. These resources are from well-known, reputable sources.
[COMMAND_EXECUTION]: The skill executes various system commands through Bash to manage the browser session and workspace. This includes starting the browser-driver.mjs as a background process using nohup, probing local dev ports with curl, and managing output directories with mkdir and rm.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external, untrusted web sites.
Ingestion points: Untrusted data enters the agent context through the browser driver's snapshot (accessibility tree), console (JavaScript logs), and annotate (visual overlays) commands, all defined in scripts/browser-driver.mjs.
Boundary markers: The agent instructions in SKILL.md lack explicit boundary markers or directives to ignore instructions potentially embedded in the retrieved web content.
Capability inventory: The agent has significant capabilities, including executing shell commands, reading/writing local files, and performing further network interactions via the browser driver.
Sanitization: The skill does not implement programmatic sanitization or filtering of retrieved web content before presenting it to the agent for analysis.

dogfood