The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The inject-auth.js script and lib/browser.js utility implement a mechanism to store sensitive session data, including cookies, Bearer tokens, and local/session storage items, into a local file named .auth-session.json. This file contains authentication credentials in plaintext and is configured to remain valid for 24 hours, posing a risk of credential exposure if the project directory is improperly secured or shared.
[DYNAMIC_EXECUTION]: The evaluate.js script allows for the execution of arbitrary JavaScript within the browser's page context using the eval() function. While this is a core feature for web debugging, it provides a direct execution vector that could be exploited if an agent is manipulated into running malicious scripts provided by an external source.
[PRIVILEGE_ESCALATION]: The install-deps.sh script requires sudo privileges to install a wide range of system libraries (e.g., libnss3, libgbm1, libatk) across various Linux distributions (Ubuntu, Debian, Fedora, Arch). The skill's documentation also encourages users to run sudo apt-get install imagemagick for optional features.
[PERSISTENCE]: The skill maintains browser state across multiple process executions by saving the Puppeteer WebSocket endpoint to a local file .browser-session.json. This persistence mechanism allows subsequent script calls to hijack or continue an existing browser session until the browser is explicitly closed.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a high attack surface for indirect prompt injection as it is designed to ingest and interact with untrusted web content.
Ingestion points: Web pages are read via navigate.js, snapshot.js, and aria-snapshot.js (accessibility tree parsing).
Boundary markers: The lib/selector.js file includes a validateXPath function that attempts to block dangerous patterns like javascript:, <script>, and onerror=, but this does not cover all injection vectors.
Capability inventory: The skill provides powerful interaction tools including click.js, fill.js, inject-auth.js (for session manipulation), and evaluate.js (for arbitrary JS execution).
Sanitization: While XPath validation is present, the skill lacks comprehensive sanitization for data extracted from pages before it is potentially used in downstream agent reasoning or tool calls.
[COMMAND_EXECUTION]: Several scripts (install.sh, install-deps.sh, inject-auth.js) facilitate the execution of system commands or browser-level operations based on user-supplied or external inputs.

chrome-devtools