faster-chrome-devtools-skill
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is installed from an external repository using npx skills add zeke/faster-chrome-devtools-skill.
- [COMMAND_EXECUTION]: The skill relies on executing node scripts/cdp.mjs to perform a wide range of browser automation tasks, including navigation and interaction with elements.
- [DATA_EXFILTRATION]: The skill can extract data from the browser context using commands like get-text, snapshot, and screenshot, which could potentially capture sensitive information if the agent navigates to protected or internal web pages.
- [PROMPT_INJECTION]: The skill's architecture creates an indirect prompt injection surface by ingesting untrusted data from the web and providing high-privilege interaction capabilities.
- Ingestion points: Browser page content, accessibility tree, and console logs accessed via scripts/cdp.mjs.
- Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided in the skill instructions.
- Capability inventory: High-privilege actions including JavaScript execution (eval), navigation, element interaction, and raw CDP method calls.
- Sanitization: The skill does not describe any methods for sanitizing or validating content retrieved from external websites.
Audit Metadata