The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements an eval command that uses Runtime.evaluate to execute arbitrary JavaScript within the context of the user's browser. It also includes an evalraw command for sending raw CDP methods, providing high-privilege control over the browser session.
[DATA_EXFILTRATION]: The skill programmatically scans sensitive file paths in the user's home directory across multiple operating systems (macOS, Linux, Windows) to locate DevToolsActivePort files. These files contain the debugging ports and paths required to hijack or control running browser instances.
[DYNAMIC_EXECUTION]: The skill employs a background daemon architecture. It uses child_process.spawn to launch itself as a persistent background process (_daemon mode) that maintains the WebSocket connection to the browser and communicates with the CLI via Unix domain sockets or Windows named pipes. The daemon includes a 20-minute idle timeout persistence mechanism.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill retrieves page content, accessibility trees (snap), and HTML (html) from arbitrary external websites visited by the user.
Boundary markers: Results are returned to the agent as JSON strings, but the content within the text or html fields is untrusted and lacks specific sanitization against embedded instructions.
Capability inventory: The skill possesses high-impact capabilities including arbitrary JavaScript execution (eval), navigation (nav), and automated form interaction (type, click).
Sanitization: There is no evidence of filtering or escaping web content to prevent it from being interpreted as instructions by the LLM.

chrome-cdp