The Agent Skills Directory

[SAFE]: The overall architecture follows best practices for browser automation tools, including session isolation and automated cleanup of temporary profile data.
[COMMAND_EXECUTION]: The skill uses child_process.spawn and execFileSync to manage Chrome processes and perform platform-specific tasks like finding PIDs and downscaling screenshots. These are necessary for its core functionality and operate on local system resources.
[DYNAMIC_EXECUTION]: The skill provides an eval action that executes JavaScript within the browser context via the CDP Runtime.evaluate command. While powerful, this is a standard feature for browser control and is restricted to the browser environment.
[REMOTE_CODE_EXECUTION]: An automated scanner flagged a piped execution pattern in test-raw.sh (curl ... | node). However, technical review confirms this is a false positive: the node command executes a hardcoded local script string to parse JSON metadata from the local Chrome debugging port, rather than executing arbitrary code from a remote source.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to ingest and process content from arbitrary web pages, it possesses an inherent attack surface for indirect prompt injection. To mitigate this, the skill includes a credential-guard.js component that uses pattern matching to detect and redact credential-shaped content (e.g., Slack tokens, GitHub PATs) from auto-captured data and DOM summaries.
[DATA_EXPOSURE & EXFILTRATION]: The skill implements strict controls to prevent sensitive data leakage. The credential-guard.js module actively monitors page content for secrets and suppresses auto-capture when such data is detected. Furthermore, it redacts these values from the tool's output.

browsing