browser-cdp
Use this skill when you need to control a Chrome browser via CDP (Chrome DevTools Protocol) to reuse existing login sessions. Covers: launching Chrome in debug mode, opening URLs, waiting for page load, evaluating JavaScript, taking snapshots, and extracting auth tokens. Trigger phrases: browser automation, CDP, agent-browser, 浏览器操作, 操作浏览器, Chrome CDP, 复用登录态, extract token from browser.
75
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Security
3 findings: 1 critical severity, 1 high severity, 1 medium severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E004: Prompt injection detected in skill instructions.
What this means
Detected a prompt injection in the skill instructions. The skill contains hidden or deceptive instructions that fall outside its stated purpose and attempt to override the agent’s safety guidelines or intended behavior.
Why it was flagged
The skill contains explicit instructions and tooling to extract authentication tokens/cookies and to copy browser profile/auth files (localStorage, cookies, Login Data), which enables secret exfiltration and unauthorized account access.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill explicitly instructs running evals that read localStorage tokens or document.cookie and to "extract auth tokens," which requires the agent/LLM to receive and potentially include secret token values verbatim in outputs or subsequent commands.
W013: Attempt to modify system services in skill instructions.
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
The skill explicitly instructs running scripts that will kill the user's regular Chrome processes, delete/reset a debug profile (clearing ~/chrome-debug-profile), and run destructive kill/taskkill commands (and suggests a global npm install), i.e. it directs state-changing and potentially destructive operations on the host even if it recommends obtaining user consent first.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该 skill 的运行时路径只会读取本机 Chrome 的 CDP 端点响应（如 `http://127.0.0.1:<port>/json/version`）并通过 `agent-browser --cdp <port> eval`/`open` 读取页面内容，未包含从外部/陌生来源直接摄取的 free-text输入通道（除非调用方自行提供 `<URL>`）。
- Repository
- worldwonderer/oh-story-claudecode
- Commit
5de060f
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.