The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a binary from an unverified third-party repository using brew install aeroxy/tap/chrome-devtools or cargo install chrome-devtools-cli.
[DATA_EXPOSURE]: The CLI tool automatically reads sensitive files from Chrome's user data directories to locate the DevToolsActivePort file. The targeted paths include ~/Library/Application Support/Google/Chrome/, ~/.config/google-chrome/, and %LOCALAPPDATA%\Google\Chrome\User Data\.
[DYNAMIC_EXECUTION]: The evaluate command allows for the execution of arbitrary JavaScript code within the context of active browser tabs. This capability can be used to extract DOM content, cookies, or other session-specific data. Additionally, the execute-3p-tool command facilitates the execution of third-party injected DevTools.
[COMMAND_EXECUTION]: The skill relies on the local execution of the chrome-devtools CLI tool to interact with the browser and manage a background daemon.
[PERSISTENCE]: The skill spawns a background daemon that listens on a Unix socket (/tmp/chrome-devtools-daemon.sock) to maintain a persistent connection to the browser. While it has an auto-exit timeout of 5 minutes, it remains active in the background without explicit user management during that window.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interact with untrusted web content which may contain malicious instructions targeting the agent.
Ingestion points: Web page content accessed via snapshot, evaluate, and wait-for (SKILL.md).
Boundary markers: None identified in the provided instructions.
Capability inventory: The skill possesses capabilities for navigation, clicking, form filling, arbitrary JS execution (evaluate), and screen capturing across all browser tabs.
Sanitization: There are no mentioned mechanisms for sanitizing or escaping the data retrieved from web pages before processing.

chrome-devtools-cli