The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external web pages, creating a vulnerability surface for indirect prompt injection.
Ingestion points: The swr_de__read_page tool fetches and returns title, readable text, and links from any path or URL on swr.de.
Boundary markers: The instructions lack explicit boundary markers or warnings for the agent to disregard instructions potentially embedded within the retrieved web content.
Capability inventory: The skill provides powerful capabilities including unbrowse.run (general task execution) and unbrowse.browse.act (browser interaction including credential autofilling), which could be manipulated if the agent follows instructions found in fetched content.
Sanitization: There is no evidence of content sanitization or validation performed on the data retrieved from swr.de before it is presented to the agent.
[EXTERNAL_DOWNLOADS]: The skill is designed to work with a remote MCP server hosted on the vendor's infrastructure.
The server.json file specifies a streamable-http remote at https://unbrowse.ai/mcp/swr.de.
The README.md and SKILL.md files provide instructions for adding this remote server to the agent's configuration.
[REMOTE_CODE_EXECUTION]: Tool execution is performed server-side on the Unbrowse platform.
The skill documentation describes how tool calls are replayed as first-party API requests on the vendor's servers.
It mentions a dynamic compilation feature where using the unbrowse.browse suite can "compile a new tool" that the server lists in subsequent sessions.

swr-de