The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/cdp.mjs script enables the execution of arbitrary JavaScript within browser tabs using the eval command. This grants the agent the capability to interact with the DOM and browser logic of any loaded page.\n- [DATA_EXFILTRATION]: The skill facilitates the extraction of sensitive information from the browser, including the accessibility tree (snap), page source (html), and potentially cookies or session tokens via JavaScript execution. While no direct exfiltration to a third party is hardcoded, these capabilities allow the agent to read and potentially exfiltrate sensitive data.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads untrusted data from web pages without sanitization.\n
Ingestion points: scripts/cdp.mjs (reads accessibility tree, HTML, and JS evaluation results).\n
Boundary markers: Absent; there are no instructions to ignore or delimit instructions found within the processed web content.\n
Capability inventory: scripts/cdp.mjs (navigation, clicking, typing, and arbitrary JS execution).\n
Sanitization: Absent; retrieved page content is passed to the agent as raw strings, allowing malicious instructions on a website to influence agent behavior.\n- [CREDENTIALS_UNSAFE]: By default, the tool targets the user's primary browser profile by accessing sensitive paths such as ~/Library/Application Support/Google/Chrome/ to locate the DevToolsActivePort file. This provides the agent with access to the user's active, authenticated web sessions, including banking, email, or internal corporate tools.

chrome-cdp