The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites through several commands that the agent can then process.
Ingestion points: Web page content is retrieved via Accessibility.getFullAXTree (used by the snap command), document.documentElement.outerHTML (used by the html command), and Runtime.evaluate (used by the eval command) in scripts/cdp.mjs.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the ingested content.
Capability inventory: The skill allows the agent to execute JavaScript in the browser (eval), navigate to arbitrary URLs (nav), take screenshots (shot), and execute raw CDP commands (evalraw). It also manages local sockets and spawns background processes (spawn).
Sanitization: No sanitization or filtering is performed on the content retrieved from web pages before it is presented to the agent.
[COMMAND_EXECUTION]: The skill spawns background daemon processes to maintain persistent connections to browser tabs.
Evidence: The main function in scripts/cdp.mjs uses child_process.spawn to launch the script itself in _daemon mode. This is used to manage the lifecycle of the connection to the browser.
[DYNAMIC_EXECUTION]: The skill enables dynamic execution of code both within the skill's execution environment and the target browser session.
Evidence: The eval and click commands utilize Runtime.evaluate over the Chrome DevTools Protocol to execute JavaScript strings within the context of the loaded web page. Additionally, the evalraw command allows for the execution of arbitrary CDP methods, providing powerful control over the browser instance.

chrome-cdp