The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute an external shell script located at /home/vic/fix-chrome-debug.sh. Executing scripts from absolute paths outside the skill's control can lead to arbitrary command execution on the host system.
[COMMAND_EXECUTION]: The documentation for manual Chrome startup includes the --no-sandbox flag. Disabling the browser sandbox is a critical security risk that allows a compromised web process to potentially escape the browser and interact directly with the underlying operating system.
[DATA_EXFILTRATION]: The instructions expose specific local user paths (e.g., /home/vic/.config/chrome-mcp-debug/). Revealing local directory structures and usernames provides reconnaissance information to a potential attacker.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. By design, the agent navigates to arbitrary URLs and extracts page content via the snapshot command. A malicious website could embed instructions in the DOM that the agent might inadvertently follow. This is particularly risky given the skill's capability to execute JavaScript via the eval command and interact with the local filesystem through the browser's user data directory.

agent-browser