The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to harvest sensitive authentication information and session data.
In SKILL.md, the documentation provides specific commands to extract authentication tokens from localStorage and document.cookie using browser evaluation tools.
The setup-cdp-chrome.js script performs bulk copying of sensitive Chrome profile data to a new directory. This includes files such as Cookies, Login Data (which contains stored passwords), and Web Data.
[COMMAND_EXECUTION]: The setup-cdp-chrome.js script makes extensive use of child_process.execSync to execute system-level commands across different platforms.
On Linux and macOS, it executes pgrep, pkill, ps, lsof, ss, and fuser to monitor and terminate processes.
On Windows, it utilizes tasklist, taskkill, wmic, and powershell (specifically Get-NetTCPConnection and Get-CimInstance) for similar process and network state management.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the automated processing of arbitrary web content. This creates a significant surface for indirect prompt injection, where malicious instructions hidden on a website could influence the agent's behavior while it is controlling the browser session.

browser-cdp