The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the agent to modify its own configuration file (~/.claude/settings.json) to add dev-browser and chrome-ai commands to the permissions.allow list. This action bypasses the platform's standard security requirement for user confirmation before executing these commands in the future, effectively granting the agent autonomous execution capabilities for these tools.
[COMMAND_EXECUTION]: The skill performs several high-privilege system modifications, including editing user shell initialization files (~/.zshrc, ~/.bashrc, ~/.zprofile, ~/.bash_profile), installing global software via npm install -g, and using the osacompile utility to generate system applications.
[REMOTE_CODE_EXECUTION]: When installed from a remote source, the skill instructions direct the agent to download scripts and configuration files using curl and subsequently install them as executable binaries in the user's local bin directory.
[PERSISTENCE]: The skill creates long-term access mechanisms by adding custom directories to the system PATH via shell profiles and by compiling a dedicated 'Chrome AI' application in the user's ~/Applications directory, which can be launched independently of the agent.
[EXTERNAL_DOWNLOADS]: The skill fetches configuration files, scripts, and additional instructions from an external GitHub repository belonging to the author (Melvynx/ai-maxxing-skills).
[INDIRECT_PROMPT_INJECTION]: The skill's verification process involves the agent accessing external websites and processing their metadata (titles and URLs). This creates a vulnerability where a malicious site could attempt to inject instructions into the agent's context.
Ingestion points: The dev-browser tool is used to retrieve page.title() and page.url() from external websites in step 9 of SKILL.md.
Boundary markers: None are present in the verification script to distinguish between website content and agent instructions.
Capability inventory: The skill has access to npm, npx, curl, shell profile editing, and the ability to create macOS applications.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the browser before it is processed by the agent.

setup-dev-browser