The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The scripts/find-url.mjs script accesses sensitive local browser files to retrieve user information. Specifically, it targets Chrome's History (SQLite database) and Bookmarks files across Windows, macOS, and Linux to extract URLs, page titles, and visit frequencies.
[COMMAND_EXECUTION]: The skill executes external system commands to facilitate its features. scripts/find-url.mjs calls the sqlite3 utility to query browser databases, and scripts/check-deps.mjs uses spawn to initiate the CDP proxy as a background process.
[DYNAMIC_EXECUTION]: The scripts/cdp-proxy.mjs component implements a /eval API endpoint. This allows the AI agent to execute arbitrary JavaScript code within any active browser tab connected via the proxy, providing full control over the DOM and session.
[INDIRECT_PROMPT_INJECTION]: The skill's core purpose is to ingest and interact with untrusted third-party web content, creating a significant surface for indirect prompt injection attacks.
Ingestion points: Data is retrieved from the web via WebFetch, curl commands, and DOM extraction through the CDP Proxy /eval and /info endpoints.
Boundary markers: The instructions do not establish strict boundary markers or validation for external web data before it is processed by the agent.
Capability inventory: The skill possesses capabilities for reading local sensitive files (browser data), executing subprocesses, and performing arbitrary browser automation (including navigation and file uploads).
Sanitization: There is no evidence of sanitization or filtering of external content within the skill's scripts before the data is returned to the agent's context.

web-access