The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from the web (HTML, accessibility trees) and provides powerful capabilities such as JavaScript execution and navigation, creating a surface for indirect prompt injection attacks.
Ingestion points: Reading accessibility trees (snap), HTML content (html), and network performance entries (net) in scripts/cdp.mjs.
Capability inventory: Arbitrary JavaScript execution (eval), element interaction (click, type), and navigation (nav) in scripts/cdp.mjs.
Boundary markers: The skill does not use specific delimiters or instructions to help the agent distinguish between tool output and potential embedded instructions in the retrieved content.
Sanitization: Content retrieved from web pages is not sanitized or filtered before being returned to the agent.
[DYNAMIC_EXECUTION]: The skill implements commands that allow for the execution of arbitrary code and protocol methods within the browser context.
The eval command in scripts/cdp.mjs uses Runtime.evaluate to execute strings provided by the agent in the page context.
The evalraw command allows for the execution of raw Chrome DevTools Protocol methods, providing direct access to low-level browser automation.
[DATA_EXFILTRATION]: The skill accesses browser profile directories to read metadata files required for connection.
The getWsUrl function in scripts/cdp.mjs reads DevToolsActivePort files from various sensitive locations, including user application data and configuration directories (~/Library/Application Support/, ~/.config/, %LOCALAPPDATA%).

chrome-cdp