The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface as it is designed to browse and ingest content from arbitrary external websites.
Ingestion points: External untrusted data enters the agent context through commands like browse goto, browse text, browse html, and browse snapshot as detailed in SKILL.md and references/commands.md.
Boundary markers: The skill explicitly includes an opt-in --content-boundaries flag to wrap page content in nonce-delimited markers as a defense mechanism, which reduces the severity of the injection surface.
Capability inventory: The execution environment allows powerful actions including execution of arbitrary JavaScript via browse js, form filling with browse fill, clicks via browse click, and file uploads via browse upload using the authorized Bash tool.
Sanitization: Content sanitization and domain restriction can be explicitly configured via the --allowed-domains and --content-boundaries flags to limit exposure to malicious inputs.

browse