The Agent Skills Directory

[DYNAMIC_EXECUTION]: The eval.js script executes arbitrary JavaScript code provided via command-line arguments within the active browser tab using the eval() function.
Evidence: eval.js line 25 uses eval("(async () => ${expr})()") to run the input string expr in the page context.
[DATA_EXPOSURE]: The start.js script includes functionality to locate and copy the user's primary Chrome profile (including cookies, session tokens, and history) to a temporary directory when the --profile flag is used.
Evidence: start.js lines 42-49 identify the platform-specific Chrome user data directory (e.g., ~/Library/Application Support/Google/Chrome on macOS) and use cpSync to recursively copy the 'Default' profile to a temporary location.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by navigating to arbitrary URLs and extracting text or interactive elements from those pages.
Ingestion points: nav.js (navigates to untrusted URLs), pick.js (extracts text content from DOM elements), screenshot.js (captures page visuals).
Boundary markers: None present; the agent processes the raw output of the browser interaction.
Capability inventory: The skill can execute arbitrary JavaScript (eval.js), spawn shell processes (start.js), and write files to the system (screenshot.js).
Sanitization: No validation or sanitization is performed on the content retrieved from external websites before it is presented to the agent.
[COMMAND_EXECUTION]: The skill programmatically spawns a browser process with remote debugging enabled, allowing local control over the browser instance via the Chrome DevTools Protocol (CDP).
Evidence: start.js line 61 uses child_process.spawn to start Chrome with the --remote-debugging-port=9222 flag.

browser