The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/capture.mjs script uses node:child_process.spawn to launch a headless Chrome or Chromium browser. It attempts to locate existing browser installations on the host system or uses a path provided via the CHROME environment variable.- [DYNAMIC_EXECUTION]: The scripts/capture.mjs utility accepts arbitrary JavaScript code as command-line arguments and executes it within the context of the loaded web page using the Runtime.evaluate method of the Chrome DevTools Protocol. This allows the agent to programmatically interact with page elements (clicking, scrolling, etc.) but constitutes a dynamic code execution vector.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to load and capture arbitrary URLs. This creates an attack surface where a maliciously crafted web page could attempt to influence the agent's behavior through visual content or text that the agent is instructed to "look at" before sending.
Ingestion points: The scripts/capture.mjs script takes a URL as an input to be rendered in the browser.
Boundary markers: None identified; the agent is simply instructed to capture the state.
Capability inventory: The skill can spawn browser processes, write files to disk (writeFileSync), and execute JavaScript within the browser environment.
Sanitization: There is no validation or sanitization of the input URL or the JavaScript steps executed within the browser.

workflow-progress-screenshots