The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from user memos which could potentially contain malicious instructions designed to influence agent behavior during reflective queries.
Ingestion points: User memo content is ingested into the agent context via chrome_read_page and chrome_get_web_content as detailed in SKILL.md and references/workflows.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' markers when reading memo data.
Capability inventory: The skill has access to interactive browser tools including chrome_click_element, chrome_fill_or_select, chrome_keyboard, and chrome_computer which can modify or delete user data.
Sanitization: There is no mention of sanitization, escaping, or validation of the content retrieved from the web interface before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill instructions document the use of internal web framework properties and methods (such as Vue __vue__ instances and Tiptap editor commands) to manipulate the application state and perform actions as seen in references/ui-locators.md and references/workflows.md. This involves executing logic that interacts directly with the site's runtime environment rather than just the rendered DOM.

flomo-web-crud