The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external URLs, which creates a surface for indirect prompt injection attacks.
Ingestion points: The scripts/playwright_runner.py script navigates to user-provided URLs and extracts page metadata, such as titles and console error logs, into the agent's context.
Boundary markers: The extracted web content is returned in a structured JSON format but lacks explicit delimiters or instructions telling the agent to ignore any commands potentially embedded in the page content.
Capability inventory: The skill is granted access to powerful tools like Bash, Write, and Edit, which could be targeted by instructions found on a malicious website.
Sanitization: The script does not perform filtering or sanitization on the data retrieved from the web pages before presenting it to the agent.
[EXTERNAL_DOWNLOADS]: The skill instructions and script headers recommend installing the playwright library and its browser binaries.
Evidence: pip install playwright && playwright install chromium is listed as a requirement in SKILL.md. playwright is a well-known browser automation library maintained by Microsoft.

webapp-testing