The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/cdp_channel.py accesses sensitive browser profile directories (e.g., ~/Library/Application Support/Google/Chrome) to read the DevToolsActivePort file. Access to browser profile paths is high-risk as these directories contain session cookies and history.
[DYNAMIC_EXECUTION]: The skill injects and executes arbitrary JavaScript into the user's active browser tabs using Runtime.evaluate via CDP (scripts/cdp_channel.py) and execute javascript via AppleScript (scripts/runjs.applescript). This allows the skill to perform actions with the user's active session.
[COMMAND_EXECUTION]: scripts/cdp_channel.py executes the ps utility using subprocess.run to enumerate running processes. This is used to detect automation instances and avoid routing errors when using AppleScript.
[INDIRECT_PROMPT_INJECTION]: The scripts/render_transcript.py utility processes untrusted data originating from external Claude conversations (which may include web search results) and renders it into transcripts for further agent processing.
Ingestion points: Untrusted data enters via JSON payloads fetched from the Claude web API and processed by render_transcript.py.
Boundary markers: The script employs Markdown headers (## human, ## assistant) and Obsidian callouts (> [!info]-) to delimit conversation turns and tool outputs.
Capability inventory: The skill can write rendered transcripts to the local filesystem and execute JavaScript within the browser context to download files.
Sanitization: The script uses Markdown fences to wrap content but does not perform explicit sanitization of embedded instructions within the conversation data.

read-claude-web-conversation