The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by having the agent execute a local Node.js script (scripts/cdp.mjs) to perform all actions, which constitutes arbitrary command execution on the host system within the scope of the agent's permissions.
[DATA_EXFILTRATION]: The skill is designed to target the user's active, authenticated Chrome session, explicitly advertising access to logged-in accounts, cookies, and session state. This allows an AI agent to read highly sensitive information (e.g., private emails, repository data, session tokens) from tabs like Gmail or GitHub. This information is at risk of being exfiltrated if the agent processes untrusted instructions or is directed to transmit data to an external endpoint.
[DYNAMIC_EXECUTION]: The eval and evalraw commands provide mechanisms to execute arbitrary JavaScript code and raw Chrome DevTools Protocol commands directly within the browser's execution context. This allows for sophisticated manipulation of page state and data extraction that bypasses standard UI-level interactions.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection as it ingests untrusted data from external websites.
Ingestion points: Data enters the agent context via the snap (accessibility tree), html (DOM source), and eval (JavaScript execution results) commands.
Boundary markers: The instructions do not define delimiters or specific "ignore embedded instructions" warnings to prevent the agent from accidentally or intentionally obeying commands found within the web content it reads.
Capability inventory: The skill provides powerful capabilities that could be abused by an injection, including element clicking (click), keyboard input (type), arbitrary script execution (eval), and navigation (nav).
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from the browser before it is processed by the agent.
[PRIVILEGE_ESCALATION]: The installation instructions direct the user to enable "remote debugging" in Chrome (chrome://inspect/#remote-debugging). This action intentionally lowers the browser's security boundaries to allow external programmatic control, which could be exploited by other malicious processes on the system beyond the intended agent.

chrome-cdp-live-browser