docs(skill): say that page content is data, never instructions

[basil-k-aji-dev]

Fixes #286.

Verified the report before writing anything

@TianjinAI's evidence holds at fa953dc. Re-running their searches on a fresh clone:

$ grep -rniE "prompt[ -]?injection|untrusted|malicious|never follow|ignore (previous|prior) instruction" --include='*.md' .
docs/remote-extension-connection.md:42:  ...not share it between independent running servers or untrusted OS users.

$ grep -ciE "untrusted|injection|malicious" skill/SKILL.md
0
$ grep -ciE "untrusted|injection|malicious" packages/dsh-plugin-browserskill/skill/SKILL.md
0

One hit, about BSK_HOME permissions, unrelated to page content. And the one place page data is labelled untrusted is crates/bsk-protocol/src/tools/record_v2.rs:13 — a Rust doc comment the agent never reads.

The gap stands out precisely because the skills are careful elsewhere: "Never extract credentials, cookies, tokens, or other secrets", "Never evaluate secrets", "never record banking, SSO or password-manager pages". Untrusted page content is the same class of rule and was simply absent.

What this adds

The rule goes where the reading happens — the top of Read and interact in both skills — with a one-line pointer from the standing rules at the top of each file, so an agent that only reads the header still meets it.

It names the commands that return page text (observe, get-html, snapshot, screenshot, console, network) and, separately, the element names and labels handed back to click/fill/select — TargetDescriptorV2 already documents those as untrusted page text internally, so an agent passing them around is moving page-controlled strings whether or not it realises.

It also says why this tool is different from an ordinary fetch: the read happens inside the user's real, logged-in profile, so a page that redirects the agent acts with their sessions.

AGENT_INSTALL.md asks the installing agent to repeat it to the user. Someone granting access to their logged-in browser should know a page cannot redirect the agent, and that an agent which appears to follow one has been injected rather than instructed — otherwise that behaviour reads as a malfunction rather than a defence working.

Scope

Documentation only. No sanitisation, no provenance marking, no allowlist. @TianjinAI's further suggestions — delimiting observe/get-html output, an optional domain allowlist, consent-to-consequence before consequential actions in a borrowed tab — are deliberately out of scope here; they are design decisions for the maintainers, and a missing rule is worth closing on its own.

Wording follows the issue's suggested text, tightened to the skills' existing imperative voice.

Checks

Re-running the report's own greps after the change:

File	untrusted|injection|malicious
skill/SKILL.md	0 → 2
packages/dsh-plugin-browserskill/skill/SKILL.md	0 → 2
AGENT_INSTALL.md	0 → 1

Markdown only; CI here builds and tests Rust, so nothing in this diff is exercised by it. I have not run the skills against a live browser — there is nothing executable to run.