The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation instructs users to execute dependencies using npx chrome-devtools-mcp@latest. This execution method lacks version pinning or integrity verification, creating a supply-chain risk where a compromised package version could execute arbitrary code on the user's system.
[DATA_EXFILTRATION]: The skill is designed to operate within the user's authenticated browser environment, providing access to logged-in sessions for sensitive services like Google Docs and Notion. Tools such as take_screenshot and list_network_requests facilitate the capture and potential transmission of private information.
[DYNAMIC_EXECUTION]: The evaluate_script tool allows for the execution of arbitrary JavaScript within the context of an open browser tab. This capability bypasses standard interface controls and allows for deep interaction with authenticated web applications, including the potential to access session-specific data.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted data by reading page content, DOM state, and console logs from any website the agent navigates to.
Boundary markers: No delimiters or safety instructions are provided to help the agent distinguish between legitimate data and malicious instructions embedded in web content.
Capability inventory: The skill possesses dangerous capabilities such as evaluate_script, fill_form, and upload_file, which could be triggered by malicious site content.
Sanitization: There is no evidence of sanitization or filtering of external content before it is processed by the agent.
[TIME_DELAYED_CONDITIONAL]: The skill explicitly supports 'Scheduled Tasks' for browser automation (daily, weekly, etc.). This feature allows automation workflows to run without active user presence or supervision, potentially obscuring delayed malicious activities.

claude-chrome