The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external web pages during the QA testing process.
Ingestion points: Data is ingested via browser_snapshot() (DOM content), browser_vision() (visual content and element labels), and browser_console() (JavaScript console logs and error messages) across the testing workflow described in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters used to warn the agent that content retrieved from the browser tools might contain malicious instructions that should be ignored or treated strictly as data.
Capability inventory: The skill possesses significant interaction capabilities including browser_click, browser_type, browser_press, and browser_navigate in SKILL.md, as well as file writing capabilities used to generate the final report file.
Sanitization: No sanitization, escaping, or filtering is performed on the content retrieved from the browser before it is processed by the agent or included in the final generated report.

dogfood