The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to configure their agent to run npx -y chrome-devtools-mcp@latest. This pattern downloads and executes code from the NPM registry at runtime without version pinning, which allows for potential execution of malicious updates. This is found in references/setup.md within the mcpServers configuration for Claude Code and Codex.
[EXTERNAL_DOWNLOADS]: The use of npx to fetch chrome-devtools-mcp@latest involves downloading code from a remote registry every time the server is initialized.
[PERSISTENCE]: The skill provides instructions to modify ~/.claude.json and ~/.codex/config.toml to define mcpServers that are automatically executed by the agent runtime upon startup, establishing a persistent execution mechanism.
[COMMAND_EXECUTION]: The skill requires the creation and execution of several local scripts: an AppleScript application (Edge (Agent).app) that uses do shell script to launch a browser with remote debugging enabled, and a bash wrapper (agent-edge) that executes lsof, ps, curl, and the agent-browser utility.
[DYNAMIC_EXECUTION]: The skill involves the generation and execution of a bash script (agent-edge) and an AppleScript application to control browser behavior at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to browse and process content from external websites, such as avito.ru. This introduces an attack surface where malicious content on these pages could influence the agent's behavior. Ingestion points are located in SKILL.md under the Avito traffic discipline section, with capabilities including network operations and browser control, but no explicit sanitization for page content processing is mentioned.

x9-browser-session