The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx -y chrome-devtools-mcp@latest to dynamically download and execute an external package from the public NPM registry. The use of the @latest tag without version pinning or integrity verification introduces a significant supply chain risk, as a compromise of the package could lead to arbitrary code execution on the host system.
[DATA_EXFILTRATION]: The get_network_request tool allows the agent to retrieve full details of network traffic, including sensitive request/response bodies, headers, and query parameters. This capability could be used to exfiltrate PII, session tokens, or other sensitive data from web applications visited during the session.
[COMMAND_EXECUTION]: The skill executes shell commands via npx to spawn two instances of the chrome-devtools-mcp server (headless and visible). This execution is performed locally using the host's node and npx binaries as specified in the metadata.
[CREDENTIALS_UNSAFE]: The skill relies on a persistent Chrome profile located at ~/.cache/chrome-devtools-mcp/chrome-profile. This profile is designed to store manually-authenticated sessions, meaning it contains sensitive authentication material such as cookies and session tokens. Access to this profile by the agent provides a path to high-value user credentials.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from the open web.
Ingestion points: Arbitrary web content is ingested through the navigate_page, take_snapshot, and take_screenshot tools (SKILL.md).
Boundary markers: The instructions include a "Golden Rule" for the agent to only perform read actions, but no technical boundary markers or system-level delimiters are applied to the content being read.
Capability inventory: The skill provides high-impact capabilities including click, fill, evaluate_script, get_network_request, and navigate_page (SKILL.md).
Sanitization: There is no evidence of sanitization, filtering, or escaping for the external content retrieved from the browser before it is processed by the agent.

browser-gui-inspect