The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill navigates to and processes content from untrusted external websites, which can contain malicious instructions.
Ingestion points: Web content retrieved from the start_url and pages visited during the task.
Boundary markers: No delimiters or instructions are specified to help the agent distinguish between valid tasks and instructions embedded in the webpage content.
Capability inventory: The run_browsing_task tool can perform browser interactions (clicking, typing) and send data via webhook_url.
Sanitization: No sanitization or validation of the content extracted from the web is mentioned before it is processed or transmitted.
[DATA_EXFILTRATION]: The skill allows the transmission of data extracted during browsing sessions to an external destination.
Evidence: The webhook_url parameter in run_browsing_task is used to send completion notifications and extracted data to arbitrary HTTPS endpoints.
Risk Context: When the browser is set to "local", the agent operates within the user's active desktop session, potentially allowing it to extract and exfiltrate data from the user's logged-in accounts.

yutori-browse