The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements a workflow to access and duplicate the user's primary browser profile, which contains highly sensitive credential data.
The setup-cdp-chrome.js script identifies and copies files such as Cookies, Login Data, and Web Data from platform-specific Chrome directories (e.g., Application Support/Google/Chrome on macOS or AppData/Local/Google/Chrome on Windows).
These files contain encrypted passwords, session tokens, and identity information used to maintain active logins across websites.
[COMMAND_EXECUTION]: The skill executes aggressive system-level commands to manipulate browser processes and environment states.
It uses tools like pkill, kill -9, taskkill, and wmic to terminate existing Chrome instances without ensuring user data (like unsaved tabs or forms) is preserved.
It launches a new browser instance using the --remote-debugging-port flag and a custom --user-data-dir, exposing the browser's internal control interface to the agent.
[DATA_EXFILTRATION]: The instructions explicitly guide the AI agent to extract authentication data from the browser session.
Provided examples demonstrate how to use agent-browser to execute JavaScript that retrieves localStorage tokens and document.cookie content, making this sensitive data available to the agent for potential exfiltration.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of arbitrary JavaScript within a browser environment that holds the user's active login states and personal data via the eval functionality of the agent-browser tool.

browser-cdp