The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's CLI script (sdk/browser-harness-js) automatically fetches and executes the Bun runtime installer from the official bun.sh domain if Bun is not already installed on the host system.
[DYNAMIC_EXECUTION]: The server component (sdk/repl.ts) utilizes the eval function to execute JavaScript snippets provided by the agent. This is a core architectural feature that enables the persistent session and the ability to carry state (globals) forward across separate command invocations.
[INDIRECT_PROMPT_INJECTION]: The skill provides extensive capabilities for reading data from external, untrusted web pages, creating a surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through various CDP methods described in SKILL.md and the interaction-skills/ documentation, such as reading DOM text (Runtime.evaluate), page titles, and network response bodies (Network.getResponseBody).
Boundary markers: There are no built-in boundary markers or instructions within the skill to help the agent distinguish between its own logic and malicious instructions embedded in the web content it processes.
Capability inventory: The skill provides the agent with powerful capabilities, including full browser control via CDP and access to the host file system and network through the Bun runtime (e.g., Bun.write for downloads as seen in interaction-skills/downloads.md).
Sanitization: The skill does not perform sanitization or validation on content read from the browser before it is processed by the agent.

cdp