The Agent Skills Directory

[DATA_EXFILTRATION]: The skill duplicates the user's private browser profile (including cookies, saved passwords, and login data) to a local directory ~/chrome-debug-profile. While stored locally, this creates a second, unencrypted copy of highly sensitive authentication material outside the user's standard profile management.
[DATA_EXFILTRATION]: The instructions explicitly guide the agent to perform credential harvesting from the browser session using commands like agent-browser --cdp 9222 eval 'localStorage.getItem("token") || document.cookie'. This allows for the extraction of active session tokens for any website the user is logged into.
[COMMAND_EXECUTION]: The setup-cdp-chrome.js script executes aggressive system commands to terminate running processes, including pkill -9 -x 'Google Chrome' on macOS/Linux and taskkill /F /IM chrome.exe on Windows. It also uses powershell and wmic to query process information.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface for indirect prompt injection by ingesting untrusted content from the web and processing it through an agent with the capability to execute JavaScript and access the file system.
Ingestion points: Web page content, text, and DOM elements retrieved via agent-browser (e.g., document.body.innerText).
Boundary markers: Absent. There are no delimiters or instructions to treat page content as untrusted.
Capability inventory: Process termination, file system writes (via profile copying), and arbitrary JavaScript execution via CDP eval.
Sanitization: Absent. The skill does not filter or sanitize content retrieved from the browser before the agent processes it.
[DYNAMIC_EXECUTION]: The skill relies on the dynamic execution of JavaScript provided as strings (e.g., agent-browser ... eval '...') to interact with web pages, which can be misused if the agent is influenced by malicious content on a website.

moshu-cdp