The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the local Chrome Bookmarks file, which is considered sensitive user data. The bookmark_reader.js file contains logic to locate this file within the user's LOCALAPPDATA directory (e.g., Google/Chrome/User Data/Default/Bookmarks) and read its contents using fs.readFileSync. Accessing browser profile data can expose browsing habits and internal network structures.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the bookmarks file and presents it to the agent for analysis.
Ingestion points: The parseBookmarks method in bookmark_reader.js reads and parses the JSON content of the Chrome bookmarks file.
Boundary markers: None. The extracted titles and URLs are not wrapped in security delimiters or instruction-ignore warnings.
Capability inventory: The script has filesystem read access via the fs module in bookmark_reader.js.
Sanitization: The code does not perform any sanitization, filtering, or validation of the bookmark titles or URLs before they are returned to the agent context. Maliciously crafted bookmark titles could potentially influence agent behavior during analysis.

chrome-bookmark-reader