The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES]: The docker/docker-compose.yml file contains a command that executes npm install inside the container environment every time the cdp-api service starts. This performs dynamic downloads of Node.js packages from the public npm registry at runtime without fixed integrity hashes.
[DYNAMIC_EXECUTION]: The file docker/cdp-api-server.js exposes an /evaluate REST endpoint that accepts a JavaScript expression from the request body and executes it within the browser context using eval(). This allows for arbitrary code execution within the browser environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external web pages via features like /navigate, /content, /console, and /network.
Ingestion points: Browser page navigation and content extraction in cdp-api-server.js and cdp_client.rb.
Boundary markers: None identified; untrusted web content is not delimited or sanitized before being returned to the agent.
Capability inventory: The skill provides full browser control, including JS execution, cookie manipulation, and network monitoring.
Sanitization: No sanitization or safety filtering is performed on data retrieved from external URLs.
[PRIVILEGE_ESCALATION]: The docker/docker-compose.yml file grants the SYS_ADMIN capability to the Chrome container. While often required for Chrome's sandbox in Docker, it represents a significant permission set within the container runtime environment.
[DATA_EXPOSURE]: The skill includes a hardcoded VNC password ('secret') in SKILL.md and scripts/vnc_url.sh. While this is intended for local debugging access to the Docker container, it represents a default credential pattern.

chrome-devtools