The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and extract data from external, untrusted web pages (e.g., Cloudflare Turnstile challenges and high-trust platforms like Meta or Google). Maliciously crafted content on these target pages could potentially influence the agent's behavior during the automation process.
Ingestion points: The skill uses page.evaluate(), document.querySelector(), and general scraping logic in SKILL.md to read data from the DOM.
Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore embedded instructions when reading or processing data from web pages.
Capability inventory: The skill is granted execute_command, write_file, edit_file, and create_file permissions, providing a significant capability surface if the agent is manipulated by external data.
Sanitization: While the 'Security Guardrails' section mentions validating target URLs and avoiding RCE from untrusted content, there is no technical implementation or strict pattern provided to sanitize the ingested data.
[DYNAMIC_EXECUTION]: The skill heavily relies on injecting JavaScript into the browser context using page.evaluate() and page.addInitScript() to manipulate fingerprints and solve challenges.
[COMMAND_EXECUTION]: The skill configuration allows for execute_command, which is intended for running automation scripts, browser engines, and testing tools as part of the development workflow.

create-automation-script