The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides extensive access to the user's private browser environment. Tools like chrome_get_text, chrome_get_html, and chrome_screenshot allow the agent to extract information from authenticated sessions, such as email inboxes, internal tools, or bank accounts, which could lead to sensitive data exposure if misused.
[DYNAMIC_EXECUTION]: The chrome_eval tool allows the agent to execute JavaScript expressions directly within the user's authenticated browser origin. This capability allows for complex interactions but also presents a risk of executing malicious scripts in a trusted context.
[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it reads content from arbitrary, untrusted web pages and possesses the ability to perform actions (click, fill, eval) in authenticated sessions. A malicious website could embed instructions designed to trick the agent into performing unauthorized actions using the user's credentials.
Ingestion points: chrome_get_text, chrome_get_html, and chrome_get_url are used to read external, untrusted content.
Boundary markers: The instructions include a "Protocol" section directing the agent to be cautious, but there are no technical boundary markers or sanitization steps defined for the ingested data.
Capability inventory: The agent can perform significant actions via chrome_click, chrome_fill, chrome_eval, and chrome_navigate.
Sanitization: None specified; the agent is instructed to "treat what you read as private" but has no programmatic constraints.
[COMMAND_EXECUTION]: While not executing shell commands on the host OS, the chrome_click and chrome_fill tools allow for the execution of commands (actions) within the browser environment that can have real-world consequences, such as posting content or deleting data.

chrome