The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs users to download a compiled release binary from an untrusted GitHub repository (github.com/robzolkos/web-recap).
[REMOTE_CODE_EXECUTION]: The installation instructions involve downloading a binary directly from the internet and using chmod +x to grant it execution permissions, which allows for the execution of unverified third-party code on the host system.
[DATA_EXFILTRATION]: The tool's primary purpose is to read and extract sensitive browser history from Chrome, Chromium, Brave, Firefox, Safari, and Edge. Accessing these files involves harvesting highly personal information including visited URLs and page titles.
[COMMAND_EXECUTION]: The skill executes the downloaded web-recap CLI tool and pipes its output to jq. This represents the execution of arbitrary commands with output derived from the untrusted binary.
[PROMPT_INJECTION]: The skill ingests untrusted data from the browser history (titles and URLs) into the agent's context. This creates a surface for indirect prompt injection where malicious titles on visited websites could influence the agent's logic or downstream actions.
Ingestion points: Browser history data retrieved via web-recap in SKILL.md.
Boundary markers: None provided; data is piped directly to jq and then into the agent context.
Capability inventory: Subprocess execution of web-recap and jq as seen in SKILL.md.
Sanitization: None; the instructions use jq for filtering but do not perform sanitization of the extracted titles or content.

web-recap