The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts including scripts/browser_launcher.py, scripts/cdp_proxy.py, and scripts/cdp_client.py utilize the Python subprocess module. These calls are used for browser lifecycle management (launching/stopping processes), system path detection for different browsers (Chrome, Edge, QQ), and installing Python dependencies.
[EXTERNAL_DOWNLOADS]: The SKILL.md instructions and scripts/cdp_client.py contain logic to automatically install the websockets Python library via pip if it is not detected on the system. This is a standard requirement for WebSocket-based CDP communication.
[DATA_EXFILTRATION]: The skill has the capability to access sensitive browser data, including cookies and user profile information, through the Network.getCookies CDP command and by accessing the user's browser data directory. This functionality is documented and matches the primary purpose of accessing authenticated web sessions.
[COMMAND_EXECUTION]: The scripts/browser_actions.py file implements the evaluate method, which uses the Runtime.evaluate CDP command to execute arbitrary JavaScript within the browser's context. This is a standard feature for web automation but allows for high-level control over the browser session.
[SAFE]: The navigate function in scripts/browser_actions.py includes proactive security measures against Server-Side Request Forgery (SSRF). It implements a whitelist of allowed URL schemes and blocks navigation to private IP addresses and cloud metadata endpoints (e.g., 169.254.169.254).
[SAFE]: The scripts/cdp_proxy.py script implements a local proxy to facilitate communication between the agent and the browser. It generates a random 32-character authentication token for each session to ensure that only authorized local connections can access the CDP interface.

browser-cdp