The Agent Skills Directory

[COMMAND_EXECUTION]: In scripts/screenshot.js, the compressImageIfNeeded function constructs shell commands (using magick or convert) by interpolating the --output file path directly into the command string without sanitization. This allows for arbitrary command execution on the host system via shell metacharacters (e.g., ;, &, |) in the filename.
[REMOTE_CODE_EXECUTION]: The scripts/evaluate.js script allows executing arbitrary JavaScript code within the browser context using page.evaluate() and eval(). This provides a direct path for executing untrusted code if the input script is influenced by external or malicious data.
[DATA_EXFILTRATION]: The combined capabilities of scripts/network.js (capturing headers and POST data), scripts/console.js (monitoring logs), and scripts/evaluate.js (extracting DOM content) allow the agent to scrape sensitive information, such as session cookies and CSRF tokens, which could then be exfiltrated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it navigates to and parses data from untrusted URLs. 1. Ingestion points: navigate.js, snapshot.js, and evaluate.js (scripts/). 2. Boundary markers: None identified. 3. Capability inventory: Subprocess execution via execSync (screenshot.js), file system writes, and full network access via Puppeteer. 4. Sanitization: No sanitization is performed on the content retrieved from web pages.
[COMMAND_EXECUTION]: The scripts/install-deps.sh and scripts/install.sh scripts use sudo to install system packages. This represents a high-privilege operation that increases the attack surface during the setup phase.

chrome-devtools