The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from external websites.
Ingestion points: The skill uses npx agent-browser snapshot and npx agent-browser screenshot to ingest content from arbitrary URLs provided by the user (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following malicious instructions found within the audited web pages.
Capability inventory: The agent has access to the Bash tool (restricted to npx agent-browser:* commands) and the Read tool (restricted to /tmp/*), which allow it to navigate, click elements, and read temporary files (SKILL.md).
Sanitization: No sanitization or filtering of the retrieved web content is performed before the agent analyzes it.
[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the agent-browser tool at runtime.
Evidence: The skill instructions (README.md and SKILL.md) call for npx agent-browser install and various npx agent-browser subcommands.

portfolio-audit