The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's setup script (scripts/setup-cdp-chrome.js) duplicates the user's primary Google Chrome profile, including sensitive files like Cookies, Login Data (passwords), and Web Data, to a separate directory ~/chrome-debug-profile. This exposes the user's entire browser credential store to the agent and any other tools with access to the home directory.
[DATA_EXPOSURE]: The instructions explicitly provide commands for the agent to extract authentication tokens from the browser context using localStorage.getItem("token") and document.cookie. This facilitates the movement of sensitive credentials from the secure browser context into the agent's output logs and conversation history.
[COMMAND_EXECUTION]: The setup script executes system-level commands to terminate all running Google Chrome processes (pkill, taskkill) to re-initialize the browser with remote debugging enabled. While the script includes a consent check, this remains a high-impact operation that interferes with the user's active workspace.
[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to ingest and evaluate JavaScript on untrusted third-party web pages.
Ingestion points: Data enters the context via agent-browser --cdp 9222 eval and innerText extraction in SKILL.md.
Boundary markers: None identified; untrusted page content is interpolated directly into the agent's context.
Capability inventory: The skill allows arbitrary JS execution (eval), process termination, and file system modifications (profile copying).
Sanitization: No evidence of sanitization or filtering of content retrieved from web pages before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill relies on the agent-browser tool to execute arbitrary JavaScript strings within the browser session, which can be used to manipulate page state or exfiltrate data from the DOM.

browser-cdp