The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted HTML data through the -c (content) and -f (file) arguments. Since this content is rendered using agent-browser (which supports JavaScript execution), an attacker could embed malicious scripts or CSS to manipulate the agent's viewport or potentially exfiltrate data if the browser environment has access to sensitive local resources.
Ingestion points: The script html_to_image.sh accepts raw HTML content via the -c flag and writes it to a temporary file, or reads from a file path provided via -f.
Boundary markers: No boundary markers or 'ignore' instructions are used when passing the HTML content to the browser renderer.
Capability inventory: The skill executes agent-browser commands (CDP-based) to open local files (file://), set viewports, evaluate JavaScript ($AB eval), and take screenshots.
Sanitization: There is no sanitization or filtering of the HTML content before it is rendered by the browser.
[COMMAND_EXECUTION]: The shell script uses set -euo pipefail and handles arguments relatively safely. However, it constructs the AB command string and executes it. While the variables used in these executions (WIDTH, HEIGHT, CDP_PORT) are largely controlled by the user, the execution of arbitrary HTML/JS in a browser context is the primary functional risk.

html-to-image