The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted UI data from external applications, which can serve as a vector for indirect prompt injection. Combined with the skill's high-impact interaction capabilities, this presents a risk of manipulated agent behavior.
Ingestion points: UI trees gathered through describe, native-describe-screen, and debugger-component-tree, as well as visual data from screenshot (documented in SKILL.md).
Boundary markers: There are no documented instructions for the agent to treat UI-extracted text as untrusted or to ignore embedded instructions within that text.
Capability inventory: The agent can perform significant actions based on these inputs, including simulated typing (keyboard), navigating to arbitrary URLs (open-url), and browser-level code execution (debugger-evaluate).
Sanitization: No sanitization or validation mechanisms are described for the text content extracted from application screens.
[DATA_EXFILTRATION]: The skill provides tools to access sensitive browser-related data that could potentially be exfiltrated if the agent is compromised or misled.
Evidence: The chromium-cookies and chromium-storage tools (detailed in references/chromium.md) allow the reading of all browser cookies (including HttpOnly) and Web Storage (local and session storage) for the active target.
[DYNAMIC_EXECUTION]: The skill supports executing arbitrary scripts within Chromium-based application environments.
Evidence: The debugger-evaluate tool (referenced in references/chromium.md) allows for the evaluation of JavaScript code directly within the context of the active browser tab.

argent-device-interact