The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/screenshot.js file contains a command injection vulnerability within the compressImageIfNeeded function. The script uses execSync to run ImageMagick commands (e.g., magick "${filePath}" ...). The filePath variable is derived directly from the user-supplied --output argument. Because this path is interpolated into a shell command string without sanitization against shell metacharacters, an attacker could achieve arbitrary command execution by providing a malicious filename (e.g., using subshell syntax like $(command)).
[REMOTE_CODE_EXECUTION]: The scripts/evaluate.js script allows for the execution of arbitrary JavaScript within the browser's page context using eval() via Puppeteer's page.evaluate(). This creates a high-capability execution surface that can be leveraged to interact with or extract data from any website the browser navigates to.
[COMMAND_EXECUTION]: The installation scripts scripts/install.sh and scripts/install-deps.sh execute system commands with elevated privileges (sudo) to install dependencies and update package managers (apt-get, dnf, pacman). While standard for setting up browser environments on Linux, these operations involve privileged access to the host system.
[REMOTE_CODE_EXECUTION]: The skill presents a surface for indirect prompt injection due to its combination of data ingestion and high-privilege capabilities. It reads untrusted data from external websites via scripts/snapshot.js (DOM snapshots), scripts/console.js (console logs), and scripts/network.js (network traffic). This data is returned to the agent context without boundary markers or sanitization. Combined with the skill's ability to write to the local file system and execute browser-side scripts, this creates a path for malicious web content to influence agent behavior.

chrome-devtools