The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local files to discover and connect to browser debugging ports.
Evidence: The script scripts/cdp.mjs reads the DevToolsActivePort file from various browser profile directories (macOS, Windows, Linux) to establish a WebSocket connection to the user's active browser.
Risk: This grants the agent access to the user's live browser state, including open tabs, browsing history, and potentially session cookies or logged-in credentials.
[COMMAND_EXECUTION]: The skill manages background processes to maintain browser connectivity and facilitate automation.
Evidence: scripts/cdp.mjs uses node:child_process.spawn to launch a background daemon that keeps the connection alive for up to 20 minutes.
[DYNAMIC_EXECUTION]: The skill generates and executes JavaScript code within the target browser context to perform interactions.
Evidence: Interaction commands such as click, fill, and wait-for in scripts/cdp.mjs assemble JavaScript logic (e.g., MutationObserver and DOM setter templates) which are then executed via the Runtime.evaluate CDP method.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites that could potentially influence or override agent behavior.
Ingestion points: The snapshot, html, console, and failures commands in scripts/cdp.mjs retrieve data directly from the DOM, accessibility tree, and browser logs of external pages.
Boundary markers: While the skill uses backend DOM references (ref:123) to target elements, it lacks explicit delimiters or instructions for the agent to ignore potentially malicious textual content within the retrieved page data.
Capability inventory: The agent has significant control, including the ability to navigate to new URLs, fill forms, click buttons, and evaluate arbitrary JavaScript.
Sanitization: No sanitization, filtering, or validation is performed on the content retrieved from web pages before it is returned to the agent's context.

faster-chrome-devtools-skill