The Agent Skills Directory

Dynamic Execution (MEDIUM): The file references/chrome-patterns.md contains an embedded JavaScript snippet designed to be executed via javascript_tool. This script performs runtime inspection of the DOM and window objects.
Evidence: The script checks for frameworks, state management tools, and specifically searches for authentication tokens in document.cookie and localStorage (e.g., token, jwt, session_id).
Indirect Prompt Injection (LOW): As a browser automation skill, it is designed to ingest and process content from untrusted external websites.
Ingestion points: read_page, get_page_text, and read_network_requests tools in references/chrome-patterns.md.
Boundary markers: The patterns do not specify the use of delimiters (like XML tags or triple backticks) when passing scraped content back to the LLM.
Capability inventory: The skill can execute JavaScript, click elements, and navigate, which could be abused if an external site contains malicious instructions.
Sanitization: No explicit sanitization or validation of the scraped text is mentioned before it is processed by the agent.
Data Exposure (LOW): The tech stack detection script explicitly attempts to identify and extract authentication tokens and session identifiers.
Evidence: Code in references/chrome-patterns.md uses regex to match token|jwt|session_id|auth in cookies and retrieves items like access_token from local storage. While intended for documenting the 'Auth mechanism', this exposes sensitive session data to the agent's context.

product-reverse