The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/setup-cdp-chrome.js accesses and copies highly sensitive browser files including Login Data (which contains encrypted passwords), Cookies, and Web Data from the user's primary Chrome profile directory (~/Library/Application Support/Google/Chrome, ~/.config/google-chrome, etc.).
[DATA_EXFILTRATION]: The SKILL.md file provides specific recipes for extracting authentication credentials from active web sessions, such as: agent-browser --cdp 9222 eval 'localStorage.getItem("token") || document.cookie'. While no automated network transmission is present in the code, the skill is designed to harvest credentials.
[EXTERNAL_DOWNLOADS]: The skill requires the manual installation of an external binary agent-browser via npm, which is used to execute the browser control logic.
[COMMAND_EXECUTION]: The skill performs aggressive process management, including killing all running Chrome processes using pkill -9 or taskkill /F to facilitate the profile copy operation. It also relies on eval for executing arbitrary JavaScript within the browser context.

browser-cdp