The Agent Skills Directory

[COMMAND_EXECUTION]: The screenshot.js script is vulnerable to shell command injection. The value of the --output command-line argument is interpolated directly into an execSync call within the compressImageIfNeeded function. Although wrapped in double quotes, shell expansion characters such as $() or backticks in the filename allow for arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: The evaluate.js script executes arbitrary JavaScript in the browser context using eval(). While this is intended for web automation, it provides a high-risk execution vector if the agent is directed to process untrusted scripts from external sources.
[COMMAND_EXECUTION]: The skill includes install.sh and install-deps.sh scripts that perform system-wide library installations using sudo. This creates a privilege escalation surface during the skill's setup process.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface.
Ingestion points: Untrusted data enters the agent context through navigate.js, snapshot.js, console.js, and network.js.
Boundary markers: No delimiters or instructions are used to separate untrusted web content from the agent's instructions.
Capability inventory: The skill has dangerous capabilities including system command execution (screenshot.js), browser-side code execution (evaluate.js), and file writes (snapshot.js, network.js).
Sanitization: There is no sanitization of web content before it is processed, although some basic security validation exists for XPath selectors in lib/selector.js.

chrome-devtools