The Agent Skills Directory

[COMMAND_EXECUTION]: The screenshot.js script is vulnerable to command injection through the --output argument. The file path provided is interpolated into a shell command for ImageMagick compression (magick or convert) using execSync. Because the path is only wrapped in double quotes and not properly sanitized, a malicious filename containing double quotes and shell operators (e.g., image.png"; touch RCE; ") will result in arbitrary command execution on the host system.
[DYNAMIC_EXECUTION]: The skill employs several high-risk dynamic execution patterns. The evaluate.js script uses eval() to execute arbitrary JavaScript within the browser context. Furthermore, scripts/lib/browser.js configures Puppeteer to launch Chromium with the --no-sandbox and --disable-setuid-sandbox flags. This disables the primary security layer of the browser, meaning that a vulnerability in the browser triggered by a malicious website could lead directly to a compromise of the host environment.
[PRIVILEGE_ESCALATION]: The install-deps.sh script is designed to be run with sudo to install system-level browser dependencies. While documented, this encourages the use of elevated privileges within the skill's management lifecycle.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection as it ingests large amounts of untrusted data from external websites.
Ingestion points: DOM data from snapshot.js, browser console messages from console.js, and full network traffic (headers and bodies) from network.js.
Capability inventory: Host-level command execution (via the screenshot.js vulnerability), arbitrary browser-side JavaScript execution (evaluate.js), and file system writes.
Boundary markers: The skill includes an XPath validator in scripts/lib/selector.js that blocks patterns like javascript:, <script, and onerror=, which provides some protection against basic injection via selectors.
Sanitization: There is no significant sanitization of the data retrieved from web pages before it is returned to the agent's context.
[DATA_EXPOSURE]: The network.js script captures and outputs full network transaction details, including sensitive HTTP headers such as Authorization or Cookie and POST request bodies, which could lead to the exposure of credentials and session tokens during automation tasks.

chrome-devtools