The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The script scripts/install-deps.sh uses sudo to install system packages on Linux distributions (Ubuntu, Debian, Fedora, Arch, etc.). While required for Chrome dependencies, this allows the agent to execute commands with elevated privileges.
[DYNAMIC_EXECUTION]: The script scripts/evaluate.js uses eval() to execute arbitrary JavaScript code passed as a command-line argument within the browser context. Additionally, SKILL.md encourages the agent to generate and execute custom JavaScript files in the tmp/ directory.
[DATA_EXPOSURE]: The skill implements session persistence by saving browser WebSocket endpoints and authentication data (including cookies, Bearer tokens, and local storage) into plain-text JSON files (.browser-session.json and .auth-session.json) within the skill's directory.
[CREDENTIALS_UNSAFE]: The scripts/inject-auth.js tool accepts sensitive authentication tokens and cookies via command-line arguments. This can result in secrets appearing in the system's process list or shell history.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted web content (HTML through snapshots, console logs, and network traffic) and provides powerful tools to interact with that content (clicking, form filling, and JavaScript execution). This constitutes an indirect prompt injection surface.
Ingestion points: aria-snapshot.js, snapshot.js, console.js, network.js.
Boundary markers: None identified in the script outputs to delimit untrusted data.
Capability inventory: File writes (screenshots, logs), JavaScript execution (evaluate.js), and simulated user interactions (click.js, fill.js).
Sanitization: lib/selector.js includes a validateXPath function that blocks some dangerous patterns (e.g., javascript:, onerror=), providing a basic layer of protection against selector-based attacks.

chrome-devtools