The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation in SKILL.md and TOOLS.md recommends invoking the skill via node -e shell commands. This execution model relies on the calling agent to properly sanitize inputs; otherwise, it could be exploited for command injection on the host system.\n- [DATA_EXFILTRATION]: The handleUpload function in index.js allows the agent to read any file from the host's filesystem and upload it to a web form. This capability poses a high risk for the exfiltration of sensitive data like SSH keys or environmental secrets.\n- [REMOTE_CODE_EXECUTION]: Through the handleEvaluate function in index.js, the skill can execute arbitrary JavaScript within the browser context. This allows an attacker to manipulate the DOM, steal session cookies, or bypass site-specific security measures.\n- [PROMPT_INJECTION]: The SKILL.md file contains instructions that attempt to override the agent's internal tool selection logic by stating it should be used instead of built-in browser tools.\n- [EXTERNAL_DOWNLOADS]: The skill uses the playwright library, which is a well-known service that automatically downloads browser binaries from official sources to enable automation tasks.\n- [DATA_EXFILTRATION]: The skill supports connecting to a user's existing Chrome instance via the Chrome DevTools Protocol (CDP) on port 9222. This grants the agent full access to the user's logged-in accounts, history, and private data in their primary browser profile.\n- [PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection.\n
Ingestion points: Content from external websites is retrieved using functions like handleGetContent in index.js.\n
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the fetched HTML.\n
Capability inventory: The toolset includes highly permissive functions such as handleEvaluate, handleUpload, and handleNavigate.\n
Sanitization: There is no evidence of filtering or validation for the content fetched from the web before it is processed by the agent.

browser-automation