The Agent Skills Directory

[DATA_EXFILTRATION]: The /setFiles API endpoint in scripts/cdp-proxy.mjs permits the agent to specify local file paths for upload through browser file inputs using the DOM.setFileInputFiles CDP command. This capability creates a significant risk of data exfiltration; if an agent visits a malicious site that uses indirect prompt injection, it could be instructed to upload sensitive local files (e.g., SSH keys, credentials) to an attacker-controlled form.\n- [INDIRECT_PROMPT_INJECTION]: Since the skill is designed to navigate and extract content from arbitrary websites, it is highly vulnerable to instructions embedded in web pages. Maliciously crafted web content could contain instructions that override the agent's behavior, leading it to perform unauthorized actions such as exfiltrating data, capturing sensitive screenshots, or manipulating the user's authenticated browser session.\n- [COMMAND_EXECUTION]: The skill relies on executing curl commands via the shell to interact with the local CDP proxy. If parameters such as target IDs, URLs, or selectors are derived from untrusted web content without adequate sanitization, it could lead to command injection on the host system.\n- [DYNAMIC_EXECUTION]: The skill's core functionality involves executing arbitrary JavaScript in the browser context via the /eval endpoint. While necessary for web automation, this allows for sophisticated interactions with web pages, including bypassing security controls or extracting sensitive information from the Document Object Model (DOM).

web-access