The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by invoking the chrome-cdp CLI tool to interact with the browser over the DevTools Protocol. This requires the binary to be present on the system's PATH.
[DYNAMIC_EXECUTION]: The skill includes several features for runtime code execution within the browser context:
The eval command allows the agent to execute arbitrary JavaScript in the top frame of the browser.
The raw command provides an interface to execute any method within the Chrome DevTools Protocol.
The recipe system executes sequences of parameterized commands from external YAML files.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill exposes several vectors for accessing and potentially exfiltrating sensitive data from the user's active Chrome session:
Tools such as snap, grid, and text extract DOM and accessibility tree content.
The net and console commands allow reading of network traffic (including payloads) and browser console logs.
The screenshot and record features capture visual data from the user's screen.
The upload command allows the agent to read local files and submit them to web forms.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where instructions embedded in processed web pages could influence the agent's behavior.
Ingestion points: Data is ingested via the snap, grid, text, find, html, and value commands in SKILL.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands in external data are documented.
Capability inventory: The skill possesses high-impact capabilities including click, fill, eval, upload, and nav as described in SKILL.md.
Sanitization: There is no mention of content filtering or sanitization for the data retrieved from external URLs.
[REMOTE_CODE_EXECUTION]: While the skill does not directly download and execute scripts via the shell, the eval functionality permits execution of code in the browser. If the agent's logic is subverted by a malicious website (via indirect injection), this tool could be abused to execute malicious JavaScript in a user's authenticated session.

drive-chrome-cdp