The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes scripts for extracting and decrypting sensitive browser cookies. The file scripts/extract_cookies.py targets browsers like Chrome, Brave, and Firefox on macOS, Linux, and Windows. It utilizes platform-specific APIs for decryption, such as macOS Keychain (security find-generic-password), Linux libsecret/SecretService, and Windows DPAPI (win32crypt.CryptUnprotectData).
[DATA_EXFILTRATION]: While intended for local session maintenance in Tier 2 browsing, the capability to scan, read, and decrypt browser session tokens and cookies from local storage constitutes a significant data exposure risk. The scripts/extract_cookies.py script specifically filters for 'IMPORTANT_COOKIES' like session IDs (SID, SSID, etc.) and provides an --inject flag to send these credentials to a local Chrome DevTools Protocol (CDP) port.
[COMMAND_EXECUTION]: The skill frequently executes shell commands and spawns subprocesses.
engine/executor.py executes Node.js templates using subprocess.run to drive Playwright.
scripts/cookie_crypto.py executes the macOS security tool via subprocess.
Various reference files (social.md, video.md, dev.md) instruct the agent to execute third-party CLI tools like xhs, twitter, rdt, yt-dlp, gh, bili, and mcporter.
[EXTERNAL_DOWNLOADS]: The skill performs runtime installation of unverified dependencies.
SKILL.md contains a shell command to auto-install curl_cffi, beautifulsoup4, and pyyaml via pip if they are missing.
references/chrome-stealth.md directs the agent to install cloakbrowser via pip and agent-browser via npm, along with installing the Chrome binary for Playwright.

ultimate-browsing