The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the 'uxc' adapter from its official GitHub repository (github.com/holon-run/uxc). This is documented as a trusted well-known dependency. The installation process in scripts/install-uxc.zsh includes strict SHA-256 integrity checks for both the archive and the extracted binary against pinned values in scripts/lib/uxc-release.zsh.
[COMMAND_EXECUTION]: The skill executes shell scripts to manage browser connectivity. These scripts (uxc-readiness.zsh, ensure-connection.zsh, etc.) are part of the skill's own code and are used to verify the state of the shared Chrome session. They avoid dangerous patterns like curl | bash and instead use localized, verified binaries.
[DATA_EXFILTRATION]: The skill explicitly forbids and includes tests to prevent the leaking of page URLs, titles, bodies, cookies, or tokens in its output. It enforces target page resolution through fresh numeric IDs rather than global selectors. Network request bodies are only stored in the OS-provided temporary directory (DARWIN_USER_TEMP_DIR).
[PRIVILEGE_ESCALATION]: The skill operates within user space and does not request sudo or modify system-level configurations. It uses a daemon-exclusive key to manage browser ownership without requiring administrative rights.
[DYNAMIC_EXECUTION]: The skill uses evaluate_script to run JavaScript within the browser context. This is the primary intended function of the skill for DOM analysis and is scoped to the specific pageId provided by the user, with instructions to avoid side effects during read-only operations.

chrome-dev-mcp