The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted content from the web.
Ingestion points: The skill uses browser_navigate to access external URLs and tools like extract_text and extract_all to ingest data from these pages into the agent's context.
Boundary markers: There are no defined boundary markers or system instructions within the skill to differentiate between legitimate user commands and instructions that might be embedded in the web pages being browsed.
Capability inventory: The skill provides high-impact capabilities including browser_click, browser_type, and browser_screenshot. If an attacker-controlled website successfully injects instructions, they could potentially trick the agent into performing actions on other sites (e.g., clicking buttons or typing data).
Sanitization: The skill does not implement any visible sanitization or filtering of the extracted web content before it is processed by the agent.

Browser Automation