The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a provided shell script scripts/capture-screenshot.sh which in turn launches a web browser process.
Evidence: SKILL.md contains the command bash scripts/capture-screenshot.sh <microsim-directory-path>.
[DATA_EXFILTRATION]: The screenshot script explicitly disables standard browser security mechanisms, which significantly increases the risk of local data exposure and exfiltration if the skill processes malicious content.
Evidence: scripts/capture-screenshot.sh executes Chrome with the flags --disable-web-security and --allow-file-access-from-files.
Risk: Disabling the Same-Origin Policy (SOP) and allowing file access from other files enables JavaScript within a rendered HTML file to read sensitive local data (such as SSH keys, configuration files, or environment variables) and potentially display it in the resulting screenshot or transmit it over the network.
[INDIRECT_PROMPT_INJECTION]: The skill processes and renders main.html files from user-supplied directories, creating a surface for indirect attacks through malicious web content.
Ingestion point: The main.html file located within the MICROSIM_DIR provided to the agent.
Boundary markers: None. The browser renders the HTML content directly without sanitization or isolation.
Capability inventory: Shell command execution (via script), local file system write (PNG output), and network access (rendering CDN resources).
Sanitization: The skill does not perform any validation or sanitization of the HTML or JavaScript content before rendering it in the headless browser environment.

microsim-screen-capture