The Agent Skills Directory

[Data Exposure & Exfiltration] (HIGH): The start.js script contains a --profile flag that copies the user's active Chrome profile directory (e.g., ~/Library/Application Support/Google/Chrome/Default on macOS) to a temporary location. This provides the agent or an attacker with access to sensitive credentials, session cookies, and browsing history.
[Dynamic Execution] (MEDIUM): The eval.js file uses the eval() function to execute arbitrary JavaScript code provided via command-line arguments within the browser context. This allows for arbitrary execution of code on web pages.
[Indirect Prompt Injection] (LOW): The skill is vulnerable to indirect prompt injection because it processes untrusted data from external websites.
Ingestion points: eval.js (returns results of script execution), pick.js (returns element text and metadata), and screenshot.js (visual output).
Boundary markers: Absent. There are no delimiters or instructions to the agent to treat the page content as untrusted.
Capability inventory: The skill allows for navigation (nav.js), code execution in the page (eval.js), and credential access (start.js).
Sanitization: No sanitization or filtering is performed on the data extracted from the browser before it is returned to the agent.
[Command Execution] (LOW): The start.js script uses child_process.spawn to execute the local Chrome binary found on the system path.

browser