The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses and clones the user's entire Google Chrome profile directory (~/Library/Application Support/Google/Chrome) to a local path. This folder contains sensitive information including session cookies for all websites, saved passwords, and browser history.
[CREDENTIALS_UNSAFE]: The skill explicitly extracts "Hydration JSON" from the ChatGPT application, which contains sensitive authentication tokens, session identifiers, and feature flags, and saves it to a file in /tmp.
[DATA_EXFILTRATION]: Extracted data, including conversation text, intercepted API responses, and session tokens, is saved to the /tmp directory. This makes sensitive user data accessible to any other process or user on the local machine.
[COMMAND_EXECUTION]: The script executes shell commands to terminate existing browser processes and launch a new Chrome instance with the --remote-debugging-port flag and a hijacked user profile.
[COMMAND_EXECUTION]: In search.mjs, the code uses the new Function() constructor to dynamically execute JavaScript logic read from the local filesystem, which is a risky code execution pattern.

chatgpt-search