The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/setup-cdp-chrome.js programmatically accesses and copies sensitive browser files that store user credentials.
Evidence: The script identifies the Chrome user data directory and copies the Cookies and Login Data (which contains saved passwords) files from the user's default profile to a debug profile folder at ~/chrome-debug-profile.
Impact: This allows the skill to bypass normal browser security boundaries and gain access to the user's stored authentication data.
[COMMAND_EXECUTION]: The skill executes forceful system-level commands to terminate running applications.
Evidence: The script uses pkill -9 -x 'Google Chrome' on macOS/Linux and taskkill /F /IM chrome.exe on Windows.
Impact: Abruptly closes all open browser windows without saving state or prompting the user, in order to relaunch Chrome with a debugging port enabled.
[DATA_EXFILTRATION]: The skill's instructions explicitly guide the agent to extract secret session identifiers.
Evidence: SKILL.md provides examples for the agent to execute JavaScript that retrieves data from localStorage.getItem("token") and document.cookie.
Impact: Specifically designed to harvest active session tokens for potentially unauthorized account access.

browser-cdp