The Agent Skills Directory

[DATA_EXFILTRATION]: The skill facilitates access to sensitive user data. In the troubleshooting section of SKILL.md, it instructs users to copy their primary Google Chrome profile directory ("~/Library/Application Support/Google/Chrome") to a debug profile location. This directory contains highly sensitive information, including active session cookies, saved passwords, and browsing history.
[COMMAND_EXECUTION]: The skill makes extensive use of the agent-browser CLI to automate web interactions and includes an eval command for executing dynamic JavaScript in the browser. It supports providing scripts via Base64 encoding (-b) or standard input (--stdin), which can be used to run complex logic that is not immediately transparent in shell commands.
[PROMPT_INJECTION]: The skill has a significant indirect prompt injection attack surface because it is designed to scrape and interact with content from untrusted external websites.
Ingestion points: Data enters the agent's context through the open and snapshot commands, which retrieve and process the DOM of any visited URL.
Boundary markers: There are no instructions or delimiters provided to prevent the agent from following malicious instructions that might be embedded in the HTML or text of a processed webpage.
Capability inventory: The skill possesses powerful capabilities, such as form filling, clicking, cookie manipulation, and JavaScript execution, which could be abused if an attacker-controlled website successfully injects instructions.
Sanitization: The skill does not implement any visible sanitization or validation of the data retrieved from external sources before presenting it to the agent for decision-making.

chrome-browser