The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The browser-cookies.js script is designed to dump all cookies from the active browser tab to the standard output. When used in conjunction with the --profile flag in browser-start.js, this provides a direct path for an agent or attacker to access and exfiltrate highly sensitive session tokens for any site the user is logged into (e.g., GitHub, AWS, email).
[DATA_EXPOSURE]: The browser-start.js script includes functionality to sync the user's actual browser profile to a temporary directory. It accesses sensitive paths such as ~/Library/Application Support/Google/Chrome/ (macOS) and ~/.config/google-chrome/ (Linux) to copy cookies, logins, and session data.
[COMMAND_EXECUTION]: The browser-eval.js tool allows for arbitrary JavaScript execution within the browser's context. This is implemented by taking command-line arguments and passing them to a dynamic execution sink.
[DYNAMIC_EXECUTION]: browser-eval.js uses the AsyncFunction constructor (new AsyncFunction('return (' + c + ')')()) to execute code provided as a string at runtime. This bypasses static analysis of the code being run in the browser.
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant indirect prompt injection surface. The browser-content.js and browser-nav.js tools ingest untrusted content from the public internet. This content is then processed in a context where high-privilege tools (like browser-eval.js and browser-cookies.js) are available, potentially allowing a malicious website to trick the agent into exfiltrating the user's session data or performing unauthorized actions via the automated browser.

browser-tools