The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes multiple shell commands to manage local files and browser state. This includes using rsync to duplicate entire Chrome profile directories (which contain session cookies, history, and passwords) from ~/Library/Application Support/Google/Chrome/ to a custom debug path.
[COMMAND_EXECUTION]: An embedded Python script is executed to read and parse the user's Local State file. This file contains metadata about the user's browser profiles, which the skill uses to identify and target specific signed-in accounts.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to perform a global installation of the dev-browser NPM package. This package is an external dependency required for the skill to function but is not from a widely recognized or trusted organization.
[DYNAMIC_EXECUTION]: Arbitrary JavaScript code is passed via shell heredocs to the dev-browser tool to be executed within the context of the connected Chrome instance. This allows for dynamic control over the browser's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill provides the agent with a browser automation interface that ingests external web content while possessing shell execution capabilities. This creates a surface for indirect prompt injection attacks where malicious content on a visited website could influence the agent's actions. Mandatory Evidence:
Ingestion points: External web pages accessed through the dev-browser connection.
Boundary markers: None. The skill does not define specific delimiters or warnings for the agent to ignore instructions embedded in the browser content.
Capability inventory: The skill has access to shell execution (npm, rsync, python3, open), the local file system, and network operations.
Sanitization: No sanitization or filtering of browser content is mentioned before it is processed by the agent.

dev-browser