The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a PowerShell script (scripts/edge-profile.ps1) to clone, launch, and terminate Microsoft Edge browser instances. It also uses a Node.js script (scripts/cdp-agent.mjs) to interact with the browser via the Chrome DevTools Protocol (CDP).
[DATA_EXFILTRATION]: The skill provides automated routines to clone Microsoft Edge user profiles from %LOCALAPPDATA% and export sensitive session data—including cookies, localStorage, and sessionStorage—to a local JSON file (auth-state.json). While the documentation instructs the agent to keep this data local, the capability to programmatically extract and manipulate full browser sessions is a major data exposure vector.
[REMOTE_CODE_EXECUTION]: The scripts/cdp-agent.mjs script implements a command to execute arbitrary JavaScript code within the target browser page using the Runtime.evaluate method of the Chrome DevTools Protocol. This allows the agent to perform complex logic or data extraction beyond standard UI interactions.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It scrapes up to 30,000 characters of text from arbitrary web pages and presents it to the agent without sanitization.
Ingestion points: scripts/cdp-agent.mjs (the commandInspect function extracts innerText and interactive element metadata from the browser).
Boundary markers: No delimiters or 'ignore' instructions are used when passing scraped web content to the agent.
Capability inventory: The skill provides click, type, navigate, and evaluate (JavaScript execution) capabilities.
Sanitization: The scraped content is not sanitized, increasing the risk that malicious instructions on a web page could influence the agent to perform unauthorized actions.

sap-browser-automation