The Agent Skills Directory

[DATA_EXFILTRATION]: The skill moves entire browser user data directories, which contain sensitive information such as session cookies, browsing history, and local storage, to the ~/Desktop folder. This exposes highly sensitive personal data. If the user has cloud synchronization enabled for their Desktop (such as iCloud or OneDrive), this data may be automatically uploaded to third-party servers.
[CREDENTIALS_UNSAFE]: The backup operation targets the browser's profile directory, which contains the Login Data file used to store encrypted passwords. Moving this file to the Desktop significantly increases the risk of local credential theft and unintended exposure in synced environments.
[COMMAND_EXECUTION]: The script uses child_process.spawnSync to run osascript and killall commands. The arguments for these commands, specifically the application and process names, are taken from the user's prompt without rigorous validation. This could be exploited to terminate arbitrary system processes or execute malicious AppleScript.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion points: Browser name and support directory parameters in SKILL.md and scripts/chromium-clean-install.mjs. 2. Boundary markers: Absent. 3. Capability inventory: File system moves and copies via fs.renameSync and fs.copyFileSync in scripts/chromium-clean-install.mjs. 4. Sanitization: Source paths are used directly without verification. An attacker could exploit this to move unrelated sensitive directories (e.g., ~/.ssh or ~/.aws) to the Desktop backup location by masquerading them as browser paths.

chrome-clean-install