The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The scripts/install-deps.sh script requires root privileges to install system-level dependencies for Chrome. While this is a standard requirement for running headless browsers on Linux, it involves the execution of commands with sudo.
[COMMAND_EXECUTION]: The scripts/screenshot.js utility uses execSync to invoke ImageMagick (magick or convert) for automatic screenshot compression. Although the script attempts to wrap file paths in double quotes, there is a theoretical risk of command injection if the agent is manipulated into using a maliciously crafted output filename.
[DYNAMIC_EXECUTION]: The scripts/evaluate.js script explicitly uses eval() to execute JavaScript strings provided as command-line arguments within the page context. This is the intended functionality of the tool but represents a high-capability execution surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary web content. This content could contain instructions intended to exploit the agent's browser automation capabilities.
Ingestion points: Browser content loaded via navigate.js, snapshot.js, or evaluate.js (SKILL.md).
Boundary markers: None explicitly used for external data separation.
Capability inventory: Full browser control, file writes (screenshots, traces, JSON reports), and execution of JavaScript in-page (scripts/evaluate.js).
Sanitization: The scripts/lib/selector.js file includes a validateXPath function that implements a blocklist for dangerous patterns like <script> or onerror= to mitigate injection via element selectors.

chrome-devtools