The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The page.eval command in extension/commands.js uses the Chrome DevTools Protocol (Runtime.evaluate) to execute arbitrary JavaScript within the context of any browser tab. This allows an agent to run any code in the user's browser sessions, which can lead to full compromise of web applications.
[COMMAND_EXECUTION]: The skill implements a native messaging host (native-host/bridge.mjs) that allows a local Node.js process to bridge communications between an MCP server and the Chrome extension. This architecture involves running local scripts that handle system-level communications and process JSON data from stdin/stdout.
[DATA_EXFILTRATION]: The extension is configured with <all_urls> host permissions in manifest.json. It provides commands such as page.text, page.html, and page.screenshot that can read and transmit sensitive content from any website the user visits, including private data in authenticated sessions, as acknowledged in the safety section of SKILL.md.
[CREDENTIALS_UNSAFE]: The skill is designed to operate within the user's signed-in Chrome profile. By accessing cookies, local storage, and active SSO/2FA sessions, it grants the agent the same level of access as the user, potentially exposing sensitive credentials and identity tokens.
[PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection (Category 8).
Ingestion points: Untrusted website content enters the agent's context through page.text, page.html, and page.pick in extension/commands.js.
Boundary markers: There are no boundary markers or instructions to the agent to ignore embedded commands within the processed web data.
Capability inventory: The skill provides high-privilege capabilities including arbitrary JavaScript execution (page.eval), navigation (tabs.navigate), and automated inputs (input.click, input.type).
Sanitization: No sanitization is performed on the data read from external web pages, allowing maliciously crafted content on a website to potentially hijack the agent's browser automation flow.

computer-and-browser