The Agent Skills Directory

[DATA_EXFILTRATION]: The start.js script allows the agent to copy the user's actual browser profile (containing cookies and logins) into a temporary workspace. This exposes sensitive personal credentials and session data to the environment.
Evidence: cpSync(defaultProfile, join(tempProfile, 'Default'), { recursive: true }); in start.js specifically targets the user's Chrome data directory.
[DYNAMIC_EXECUTION]: The eval.js tool takes arbitrary strings provided as arguments and executes them using eval() within the browser's JavaScript environment.
Evidence: return await eval("(async () => ${expr})()"); in eval.js enables remote execution of any JavaScript logic passed to the skill.
[COMMAND_EXECUTION]: The skill launches the Chrome browser by spawning a system process with specific debugging and profile flags.
Evidence: spawn(chromePath, chromeArgs, { detached: true, stdio: 'ignore' }); in start.js executes the browser binary from the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate to and interact with external websites, making it vulnerable to indirect prompt injection where malicious instructions on a webpage could control the agent's next actions.
Ingestion points: Web content retrieved via nav.js and eval.js.
Boundary markers: None; there are no delimiters or instructions to treat web content as untrusted data.
Capability inventory: Ability to spawn processes, access the file system (via profile copying), and execute arbitrary JavaScript code.
Sanitization: None; raw output from the browser DOM is returned directly to the agent.

browser