The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes a local binary named ziniao-cli to perform all browser operations. This binary acts as a bridge between the AI agent and the user's local browser environment.
[DYNAMIC_EXECUTION]: The page exec command and the exec step in the automation run sequence allow for the execution of arbitrary JavaScript code strings within the context of the active browser page. This provides a mechanism to run unverified code during automation tasks.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external web pages while possessing tools with significant side-effect capabilities.
Ingestion points: The agent can retrieve external data using page content (HTML/Text) and page screenshot as described in SKILL.md and references/ziniao-page-screenshot.md.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following malicious instructions potentially embedded in the retrieved web content.
Capability inventory: The skill includes shell command execution (ziniao-cli), browser-side JavaScript execution (page exec), and local file writing (utility download).
Sanitization: No evidence of input validation or sanitization is present for data extracted from web pages before it is processed or used in subsequent steps.
[DATA_EXFILTRATION]: The utility download tool enables the agent to write arbitrary content to the local download directory. Furthermore, the core purpose of the skill is to access and manipulate data within browser sessions, which inherently includes potentially sensitive user information.

ziniao-page