The Agent Skills Directory

[COMMAND_EXECUTION]: The skill takes a user-provided URL and interpolates it directly into shell commands such as browse goto <url>. If the agent platform does not provide underlying sanitization for the <url> argument, this creates a surface for command injection attacks where a malicious user could execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill extracts content from external, untrusted web pages (including meta tags, headings, structured data, and link text) and passes it to the agent for analysis. A malicious website could embed instructions in these fields to manipulate the agent's behavior during the audit process.
Ingestion points: browse meta, browse headings, browse schema, browse links, and browse text (used for robots.txt and sitemap.xml).
Boundary markers: Absent. The instructions do not specify the use of delimiters or provide warnings to the agent to ignore instructions embedded within the audited content.
Capability inventory: The skill uses the Bash tool to execute browse CLI commands and Read to inspect files.
Sanitization: Absent. The raw extracted data is interpreted directly by the agent without filtering or escaping.

browse-seo