The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's core functionality relies on a Node.js HTTP server (sdk/repl.ts) that accepts raw JavaScript code via a POST /eval endpoint and executes it using eval().
While the server binds to 127.0.0.1, any local process can interact with it on the default port 9876 to execute arbitrary code.
The skill also uses dynamic import() in sdk/helpers.ts to load site-specific tools from the learnings/ directory based on manifest files.
[COMMAND_EXECUTION]: The harness provides an environment where the agent can execute any Node.js logic, including interacting with the host filesystem and spawning child processes.
Interaction recipes in interaction-skills/ document using node:fs for writing files and osascript via execFile for UI automation tasks.
[PERSISTENCE]: The scripts/setup script automatically modifies user shell configuration files (.zshrc, .bashrc, or .profile) to ensure the CLI tool is available in future sessions.
It appends a command to export a new directory into the user's PATH environment variable.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from any website the agent navigates to, creating a significant surface for indirect injection.
Ingestion points: Untrusted data enters the context via accessibility tree snapshots (axView in sdk/axview.ts) and async page signals (drainSignals in sdk/helpers.ts).
Boundary markers: The axView helper produces structured text but lacks explicit markers to prevent the agent from obeying instructions embedded in the web content.
Capability inventory: The skill possesses high-privilege capabilities including cookie manipulation, credential scrubbing, and arbitrary browser interaction.
Sanitization: Minimal sanitization is performed on page content before it is passed to the LLM.
[EXTERNAL_DOWNLOADS]: The skill uses curl in its bash CLI and documented fetch patterns in the interaction guides to interact with local and remote resources.
[DATA_EXPOSURE]: The tool contains logic in sdk/session.ts to scan sensitive OS directories for browser profile data to detect running Chromium instances and read their debugging ports.

cdp