The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to browse the web using tools like browser_navigate and get_browser_state. This content is processed by the agent and could contain malicious instructions intended to manipulate its behavior.
Ingestion points: Web content retrieved via get_browser_state (snapshots) and browser_navigate.
Boundary markers: None specified in the instructions to distinguish between web content and agent instructions.
Capability inventory: The agent can execute shell commands and write files inside the sandbox using space_bash, space_write, and cua sb exec.
Sanitization: No sanitization or filtering of external web content is described.
[COMMAND_EXECUTION]: The skill relies extensively on the cua CLI tool and its associated SDKs to manage system-level resources like containers and virtual machines. While these are executed within the scope of the skill's purpose, they provide a powerful interface to the local machine's container/VM runtimes.

cua-sandboxes